8560 Reference leak on ipsec_action_t

[unleashed.git] / usr / src / uts / common / inet / ip / ip_mroute.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
 */
/* Copyright (c) 1990 Mentat Inc. */

/*
 * Procedures for the kernel part of DVMRP,
 * a Distance-Vector Multicast Routing Protocol.
 * (See RFC-1075)
 * Written by David Waitzman, BBN Labs, August 1988.
 * Modified by Steve Deering, Stanford, February 1989.
 * Modified by Mark J. Steiglitz, Stanford, May, 1991
 * Modified by Van Jacobson, LBL, January 1993
 * Modified by Ajit Thyagarajan, PARC, August 1993
 * Modified by Bill Fenner, PARC, April 1995
 *
 * MROUTING 3.5
 */

/*
 * TODO
 * - function pointer field in vif, void *vif_sendit()
 */

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strlog.h>
#include <sys/systm.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/zone.h>

#include <sys/param.h>
#include <sys/socket.h>
#include <sys/vtrace.h>
#include <sys/debug.h>
#include <net/if.h>
#include <sys/sockio.h>
#include <netinet/in.h>
#include <net/if_dl.h>

#include <inet/ipsec_impl.h>
#include <inet/common.h>
#include <inet/mi.h>
#include <inet/nd.h>
#include <inet/tunables.h>
#include <inet/mib2.h>
#include <netinet/ip6.h>
#include <inet/ip.h>
#include <inet/snmpcom.h>

#include <netinet/igmp.h>
#include <netinet/igmp_var.h>
#include <netinet/udp.h>
#include <netinet/ip_mroute.h>
#include <inet/ip_multi.h>
#include <inet/ip_ire.h>
#include <inet/ip_ndp.h>
#include <inet/ip_if.h>
#include <inet/ipclassifier.h>

#include <netinet/pim.h>


/*
 * MT Design:
 *
 * There are three main data structures viftable, mfctable and tbftable that
 * need to be protected against MT races.
 *
 * vitable is a fixed length array of vif structs. There is no lock to protect
 * the whole array, instead each struct is protected by its own indiviual lock.
 * The value of v_marks in conjuction with the value of v_refcnt determines the
 * current state of a vif structure. One special state that needs mention
 * is when the vif is marked VIF_MARK_NOTINUSE but refcnt != 0. This indicates
 * that vif is being initalized.
 * Each structure is freed when the refcnt goes down to zero. If a delete comes
 * in when the recfnt is > 1, the vif structure is marked VIF_MARK_CONDEMNED
 * which prevents the struct from further use.  When the refcnt goes to zero
 * the struct is freed and is marked VIF_MARK_NOTINUSE.
 * vif struct stores a pointer to the ipif in v_ipif, to prevent ipif/ill
 * from  going away a refhold is put on the ipif before using it. see
 * lock_good_vif() and unlock_good_vif().
 *
 * VIF_REFHOLD and VIF_REFRELE macros have been provided to manipulate refcnts
 * of the vif struct.
 *
 * tbftable is also a fixed length array of tbf structs and is only accessed
 * via v_tbf.  It is protected by its own lock tbf_lock.
 *
 * Lock Ordering is
 * v_lock --> tbf_lock
 * v_lock --> ill_locK
 *
 * mfctable is a fixed size hash table of mfc buckets strcuts (struct mfcb).
 * Each mfc bucket struct (struct mfcb) maintains a refcnt for each walker,
 * it also maintains a state. These fields are protected by a lock (mfcb_lock).
 * mfc structs only maintain a state and have no refcnt. mfc_mutex is used to
 * protect the struct elements.
 *
 * mfc structs are dynamically allocated and are singly linked
 * at the head of the chain. When an mfc structure is to be deleted
 * it is marked condemned and so is the state in the bucket struct.
 * When the last walker of the hash bucket exits all the mfc structs
 * marked condemed are freed.
 *
 * Locking Hierarchy:
 * The bucket lock should be acquired before the mfc struct lock.
 * MFCB_REFHOLD and MFCB_REFRELE macros are provided for locking
 * operations on the bucket struct.
 *
 * last_encap_lock and numvifs_mutex should be acquired after
 * acquring vif or mfc locks. These locks protect some global variables.
 *
 * The statistics are not currently protected by a lock
 * causing the stats be be approximate, not exact.
 */

#define NO_VIF  MAXVIFS         /* from mrouted, no route for src */

/*
 * Timeouts:
 *      Upcall timeouts - BSD uses boolean_t mfc->expire and
 *      nexpire[MFCTBLSIZE], the number of times expire has been called.
 *      SunOS 5.x uses mfc->timeout for each mfc.
 *      Some Unixes are limited in the number of simultaneous timeouts
 *      that can be run, SunOS 5.x does not have this restriction.
 */

/*
 * In BSD, EXPIRE_TIMEOUT is how often expire_upcalls() is called and
 * UPCALL_EXPIRE is the nmber of timeouts before a particular upcall
 * expires. Thus the time till expiration is EXPIRE_TIMEOUT * UPCALL_EXPIRE
 */
#define         EXPIRE_TIMEOUT  (hz/4)  /* 4x / second  */
#define         UPCALL_EXPIRE   6       /* number of timeouts   */

/*
 * Hash function for a source, group entry
 */
#define MFCHASH(a, g) MFCHASHMOD(((a) >> 20) ^ ((a) >> 10) ^ (a) ^ \
        ((g) >> 20) ^ ((g) >> 10) ^ (g))

#define                 TBF_REPROCESS   (hz / 100)      /* 100x /second */

/* Identify PIM packet that came on a Register interface */
#define PIM_REGISTER_MARKER     0xffffffff

/* Function declarations */
static int      add_mfc(struct mfcctl *, ip_stack_t *);
static int      add_vif(struct vifctl *, conn_t *, ip_stack_t *);
static int      del_mfc(struct mfcctl *, ip_stack_t *);
static int      del_vif(vifi_t *, ip_stack_t *);
static void     del_vifp(struct vif *);
static void     encap_send(ipha_t *, mblk_t *, struct vif *, ipaddr_t);
static void     expire_upcalls(void *);
static void     fill_route(struct mfc *, struct mfcctl *, ip_stack_t *);
static void     free_queue(struct mfc *);
static int      get_assert(uchar_t *, ip_stack_t *);
static int      get_lsg_cnt(struct sioc_lsg_req *, ip_stack_t *);
static int      get_sg_cnt(struct sioc_sg_req *, ip_stack_t *);
static int      get_version(uchar_t *);
static int      get_vif_cnt(struct sioc_vif_req *, ip_stack_t *);
static int      ip_mdq(mblk_t *, ipha_t *, ill_t *,
                    ipaddr_t, struct mfc *);
static int      ip_mrouter_init(conn_t *, uchar_t *, int, ip_stack_t *);
static void     phyint_send(ipha_t *, mblk_t *, struct vif *, ipaddr_t);
static int      register_mforward(mblk_t *, ip_recv_attr_t *);
static void     register_send(ipha_t *, mblk_t *, struct vif *, ipaddr_t);
static int      set_assert(int *, ip_stack_t *);

/*
 * Token Bucket Filter functions
 */
static int  priority(struct vif *, ipha_t *);
static void tbf_control(struct vif *, mblk_t *, ipha_t *);
static int  tbf_dq_sel(struct vif *, ipha_t *);
static void tbf_process_q(struct vif *);
static void tbf_queue(struct vif *, mblk_t *);
static void tbf_reprocess_q(void *);
static void tbf_send_packet(struct vif *, mblk_t *);
static void tbf_update_tokens(struct vif *);
static void release_mfc(struct mfcb *);

static boolean_t is_mrouter_off(ip_stack_t *);
/*
 * Encapsulation packets
 */

#define ENCAP_TTL       64

/* prototype IP hdr for encapsulated packets */
static ipha_t multicast_encap_iphdr = {
        IP_SIMPLE_HDR_VERSION,
        0,                              /* tos */
        sizeof (ipha_t),                /* total length */
        0,                              /* id */
        0,                              /* frag offset */
        ENCAP_TTL, IPPROTO_ENCAP,
        0,                              /* checksum */
};

/*
 * Rate limit for assert notification messages, in nsec.
 */
#define ASSERT_MSG_TIME         3000000000


#define VIF_REFHOLD(vifp) {                     \
        mutex_enter(&(vifp)->v_lock);           \
        (vifp)->v_refcnt++;                     \
        mutex_exit(&(vifp)->v_lock);            \
}

#define VIF_REFRELE_LOCKED(vifp) {                              \
        (vifp)->v_refcnt--;                                     \
        if ((vifp)->v_refcnt == 0 &&                            \
                ((vifp)->v_marks & VIF_MARK_CONDEMNED)) {       \
                        del_vifp(vifp);                         \
        } else {                                                \
                mutex_exit(&(vifp)->v_lock);                    \
        }                                                       \
}

#define VIF_REFRELE(vifp) {                                     \
        mutex_enter(&(vifp)->v_lock);                           \
        (vifp)->v_refcnt--;                                     \
        if ((vifp)->v_refcnt == 0 &&                            \
                ((vifp)->v_marks & VIF_MARK_CONDEMNED)) {       \
                        del_vifp(vifp);                         \
        } else {                                                \
                mutex_exit(&(vifp)->v_lock);                    \
        }                                                       \
}

#define MFCB_REFHOLD(mfcb) {                            \
        mutex_enter(&(mfcb)->mfcb_lock);                \
        (mfcb)->mfcb_refcnt++;                          \
        ASSERT((mfcb)->mfcb_refcnt != 0);               \
        mutex_exit(&(mfcb)->mfcb_lock);                 \
}

#define MFCB_REFRELE(mfcb) {                                    \
        mutex_enter(&(mfcb)->mfcb_lock);                        \
        ASSERT((mfcb)->mfcb_refcnt != 0);                       \
        if (--(mfcb)->mfcb_refcnt == 0 &&                       \
                ((mfcb)->mfcb_marks & MFCB_MARK_CONDEMNED)) {   \
                        release_mfc(mfcb);                      \
        }                                                       \
        mutex_exit(&(mfcb)->mfcb_lock);                         \
}

/*
 * MFCFIND:
 * Find a route for a given origin IP address and multicast group address.
 * Skip entries with pending upcalls.
 * Type of service parameter to be added in the future!
 */
#define MFCFIND(mfcbp, o, g, rt) { \
        struct mfc *_mb_rt = NULL; \
        rt = NULL; \
        _mb_rt = mfcbp->mfcb_mfc; \
        while (_mb_rt) { \
                if ((_mb_rt->mfc_origin.s_addr == o) && \
                    (_mb_rt->mfc_mcastgrp.s_addr == g) && \
                    (_mb_rt->mfc_rte == NULL) && \
                    (!(_mb_rt->mfc_marks & MFCB_MARK_CONDEMNED))) {        \
                    rt = _mb_rt; \
                    break; \
                } \
        _mb_rt = _mb_rt->mfc_next; \
        } \
}

/*
 * BSD uses timeval with sec and usec. In SunOS 5.x uniqtime() and gethrtime()
 * are inefficient. We use gethrestime() which returns a timespec_t with
 * sec and nsec, the resolution is machine dependent.
 * The following 2 macros have been changed to use nsec instead of usec.
 */
/*
 * Macros to compute elapsed time efficiently.
 * Borrowed from Van Jacobson's scheduling code.
 * Delta should be a hrtime_t.
 */
#define TV_DELTA(a, b, delta) { \
        int xxs; \
 \
        delta = (a).tv_nsec - (b).tv_nsec; \
        if ((xxs = (a).tv_sec - (b).tv_sec) != 0) { \
                switch (xxs) { \
                case 2: \
                    delta += 1000000000; \
                    /*FALLTHROUGH*/ \
                case 1: \
                    delta += 1000000000; \
                    break; \
                default: \
                    delta += (1000000000 * xxs); \
                } \
        } \
}

#define TV_LT(a, b) (((a).tv_nsec < (b).tv_nsec && \
        (a).tv_sec <= (b).tv_sec) || (a).tv_sec < (b).tv_sec)

/*
 * Handle MRT setsockopt commands to modify the multicast routing tables.
 */
int
ip_mrouter_set(int cmd, conn_t *connp, int checkonly, uchar_t *data,
    int datalen)
{
        ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;

        mutex_enter(&ipst->ips_ip_g_mrouter_mutex);
        if (cmd != MRT_INIT && connp != ipst->ips_ip_g_mrouter) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (EACCES);
        }
        mutex_exit(&ipst->ips_ip_g_mrouter_mutex);

        if (checkonly) {
                /*
                 * do not do operation, just pretend to - new T_CHECK
                 * Note: Even routines further on can probably fail but
                 * this T_CHECK stuff is only to please XTI so it not
                 * necessary to be perfect.
                 */
                switch (cmd) {
                case MRT_INIT:
                case MRT_DONE:
                case MRT_ADD_VIF:
                case MRT_DEL_VIF:
                case MRT_ADD_MFC:
                case MRT_DEL_MFC:
                case MRT_ASSERT:
                        return (0);
                default:
                        return (EOPNOTSUPP);
                }
        }

        /*
         * make sure no command is issued after multicast routing has been
         * turned off.
         */
        if (cmd != MRT_INIT && cmd != MRT_DONE) {
                if (is_mrouter_off(ipst))
                        return (EINVAL);
        }

        switch (cmd) {
        case MRT_INIT:  return (ip_mrouter_init(connp, data, datalen, ipst));
        case MRT_DONE:  return (ip_mrouter_done(ipst));
        case MRT_ADD_VIF:  return (add_vif((struct vifctl *)data, connp, ipst));
        case MRT_DEL_VIF:  return (del_vif((vifi_t *)data, ipst));
        case MRT_ADD_MFC:  return (add_mfc((struct mfcctl *)data, ipst));
        case MRT_DEL_MFC:  return (del_mfc((struct mfcctl *)data, ipst));
        case MRT_ASSERT:   return (set_assert((int *)data, ipst));
        default:           return (EOPNOTSUPP);
        }
}

/*
 * Handle MRT getsockopt commands
 */
int
ip_mrouter_get(int cmd, conn_t *connp, uchar_t *data)
{
        ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;

        if (connp != ipst->ips_ip_g_mrouter)
                return (EACCES);

        switch (cmd) {
        case MRT_VERSION:       return (get_version((uchar_t *)data));
        case MRT_ASSERT:        return (get_assert((uchar_t *)data, ipst));
        default:                return (EOPNOTSUPP);
        }
}

/*
 * Handle ioctl commands to obtain information from the cache.
 * Called with shared access to IP. These are read_only ioctls.
 */
/* ARGSUSED */
int
mrt_ioctl(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
    ip_ioctl_cmd_t *ipip, void *if_req)
{
        mblk_t  *mp1;
        struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
        conn_t          *connp = Q_TO_CONN(q);
        ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;

        /* Existence verified in ip_wput_nondata */
        mp1 = mp->b_cont->b_cont;

        switch (iocp->ioc_cmd) {
        case (SIOCGETVIFCNT):
                return (get_vif_cnt((struct sioc_vif_req *)mp1->b_rptr, ipst));
        case (SIOCGETSGCNT):
                return (get_sg_cnt((struct sioc_sg_req *)mp1->b_rptr, ipst));
        case (SIOCGETLSGCNT):
                return (get_lsg_cnt((struct sioc_lsg_req *)mp1->b_rptr, ipst));
        default:
                return (EINVAL);
        }
}

/*
 * Returns the packet, byte, rpf-failure count for the source, group provided.
 */
static int
get_sg_cnt(struct sioc_sg_req *req, ip_stack_t *ipst)
{
        struct mfc *rt;
        struct mfcb *mfcbp;

        mfcbp = &ipst->ips_mfcs[MFCHASH(req->src.s_addr, req->grp.s_addr)];
        MFCB_REFHOLD(mfcbp);
        MFCFIND(mfcbp, req->src.s_addr, req->grp.s_addr, rt);

        if (rt != NULL) {
                mutex_enter(&rt->mfc_mutex);
                req->pktcnt   = rt->mfc_pkt_cnt;
                req->bytecnt  = rt->mfc_byte_cnt;
                req->wrong_if = rt->mfc_wrong_if;
                mutex_exit(&rt->mfc_mutex);
        } else
                req->pktcnt = req->bytecnt = req->wrong_if = 0xffffffffU;

        MFCB_REFRELE(mfcbp);
        return (0);
}

/*
 * Returns the packet, byte, rpf-failure count for the source, group provided.
 * Uses larger counters and IPv6 addresses.
 */
/* ARGSUSED XXX until implemented */
static int
get_lsg_cnt(struct sioc_lsg_req *req, ip_stack_t *ipst)
{
        /* XXX TODO SIOCGETLSGCNT */
        return (ENXIO);
}

/*
 * Returns the input and output packet and byte counts on the vif provided.
 */
static int
get_vif_cnt(struct sioc_vif_req *req, ip_stack_t *ipst)
{
        vifi_t vifi = req->vifi;

        if (vifi >= ipst->ips_numvifs)
                return (EINVAL);

        /*
         * No locks here, an approximation is fine.
         */
        req->icount = ipst->ips_vifs[vifi].v_pkt_in;
        req->ocount = ipst->ips_vifs[vifi].v_pkt_out;
        req->ibytes = ipst->ips_vifs[vifi].v_bytes_in;
        req->obytes = ipst->ips_vifs[vifi].v_bytes_out;

        return (0);
}

static int
get_version(uchar_t *data)
{
        int *v = (int *)data;

        *v = 0x0305;    /* XXX !!!! */

        return (0);
}

/*
 * Set PIM assert processing global.
 */
static int
set_assert(int *i, ip_stack_t *ipst)
{
        if ((*i != 1) && (*i != 0))
                return (EINVAL);

        ipst->ips_pim_assert = *i;

        return (0);
}

/*
 * Get PIM assert processing global.
 */
static int
get_assert(uchar_t *data, ip_stack_t *ipst)
{
        int *i = (int *)data;

        *i = ipst->ips_pim_assert;

        return (0);
}

/*
 * Enable multicast routing.
 */
static int
ip_mrouter_init(conn_t *connp, uchar_t *data, int datalen, ip_stack_t *ipst)
{
        int     *v;

        if (data == NULL || (datalen != sizeof (int)))
                return (ENOPROTOOPT);

        v = (int *)data;
        if (*v != 1)
                return (ENOPROTOOPT);

        mutex_enter(&ipst->ips_ip_g_mrouter_mutex);
        if (ipst->ips_ip_g_mrouter != NULL) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (EADDRINUSE);
        }

        /*
         * MRT_INIT should only be allowed for RAW sockets, but we double
         * check.
         */
        if (!IPCL_IS_RAWIP(connp)) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (EINVAL);
        }

        ipst->ips_ip_g_mrouter = connp;
        connp->conn_multi_router = 1;
        /* In order for tunnels to work we have to turn ip_g_forward on */
        if (!WE_ARE_FORWARDING(ipst)) {
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(connp->conn_rq, 1, SL_TRACE,
                            "ip_mrouter_init: turning on forwarding");
                }
                ipst->ips_saved_ip_forwarding = ipst->ips_ip_forwarding;
                ipst->ips_ip_forwarding = IP_FORWARD_ALWAYS;
        }

        mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
        return (0);
}

void
ip_mrouter_stack_init(ip_stack_t *ipst)
{
        mutex_init(&ipst->ips_ip_g_mrouter_mutex, NULL, MUTEX_DEFAULT, NULL);

        ipst->ips_vifs = kmem_zalloc(sizeof (struct vif) * (MAXVIFS+1),
            KM_SLEEP);
        ipst->ips_mrtstat = kmem_zalloc(sizeof (struct mrtstat), KM_SLEEP);
        /*
         * mfctable:
         * Includes all mfcs, including waiting upcalls.
         * Multiple mfcs per bucket.
         */
        ipst->ips_mfcs = kmem_zalloc(sizeof (struct mfcb) * MFCTBLSIZ,
            KM_SLEEP);
        /*
         * Define the token bucket filter structures.
         * tbftable -> each vif has one of these for storing info.
         */
        ipst->ips_tbfs = kmem_zalloc(sizeof (struct tbf) * MAXVIFS, KM_SLEEP);

        mutex_init(&ipst->ips_last_encap_lock, NULL, MUTEX_DEFAULT, NULL);

        ipst->ips_mrtstat->mrts_vifctlSize = sizeof (struct vifctl);
        ipst->ips_mrtstat->mrts_mfcctlSize = sizeof (struct mfcctl);
}

/*
 * Disable multicast routing.
 * Didn't use global timeout_val (BSD version), instead check the mfctable.
 */
int
ip_mrouter_done(ip_stack_t *ipst)
{
        conn_t          *mrouter;
        vifi_t          vifi;
        struct mfc      *mfc_rt;
        int             i;

        mutex_enter(&ipst->ips_ip_g_mrouter_mutex);
        if (ipst->ips_ip_g_mrouter == NULL) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (EINVAL);
        }

        mrouter = ipst->ips_ip_g_mrouter;

        if (ipst->ips_saved_ip_forwarding != -1) {
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mrouter_done: turning off forwarding");
                }
                ipst->ips_ip_forwarding = ipst->ips_saved_ip_forwarding;
                ipst->ips_saved_ip_forwarding = -1;
        }

        /*
         * Always clear cache when vifs change.
         * No need to get ipst->ips_last_encap_lock since we are running as
         * a writer.
         */
        mutex_enter(&ipst->ips_last_encap_lock);
        ipst->ips_last_encap_src = 0;
        ipst->ips_last_encap_vif = NULL;
        mutex_exit(&ipst->ips_last_encap_lock);
        mrouter->conn_multi_router = 0;

        mutex_exit(&ipst->ips_ip_g_mrouter_mutex);

        /*
         * For each phyint in use,
         * disable promiscuous reception of all IP multicasts.
         */
        for (vifi = 0; vifi < MAXVIFS; vifi++) {
                struct vif *vifp = ipst->ips_vifs + vifi;

                mutex_enter(&vifp->v_lock);
                /*
                 * if the vif is active mark it condemned.
                 */
                if (vifp->v_marks & VIF_MARK_GOOD) {
                        ASSERT(vifp->v_ipif != NULL);
                        ipif_refhold(vifp->v_ipif);
                        /* Phyint only */
                        if (!(vifp->v_flags & (VIFF_TUNNEL | VIFF_REGISTER))) {
                                ipif_t *ipif = vifp->v_ipif;
                                ilm_t *ilm = vifp->v_ilm;

                                vifp->v_ilm = NULL;
                                vifp->v_marks &= ~VIF_MARK_GOOD;
                                vifp->v_marks |= VIF_MARK_CONDEMNED;

                                mutex_exit(&(vifp)->v_lock);
                                if (ilm != NULL) {
                                        ill_t *ill = ipif->ipif_ill;

                                        (void) ip_delmulti(ilm);
                                        ASSERT(ill->ill_mrouter_cnt > 0);
                                        atomic_dec_32(&ill->ill_mrouter_cnt);
                                }
                                mutex_enter(&vifp->v_lock);
                        }
                        ipif_refrele(vifp->v_ipif);
                        /*
                         * decreases the refcnt added in add_vif.
                         * and release v_lock.
                         */
                        VIF_REFRELE_LOCKED(vifp);
                } else {
                        mutex_exit(&vifp->v_lock);
                        continue;
                }
        }

        mutex_enter(&ipst->ips_numvifs_mutex);
        ipst->ips_numvifs = 0;
        ipst->ips_pim_assert = 0;
        ipst->ips_reg_vif_num = ALL_VIFS;
        mutex_exit(&ipst->ips_numvifs_mutex);

        /*
         * Free upcall msgs.
         * Go through mfctable and stop any outstanding upcall
         * timeouts remaining on mfcs.
         */
        for (i = 0; i < MFCTBLSIZ; i++) {
                mutex_enter(&ipst->ips_mfcs[i].mfcb_lock);
                ipst->ips_mfcs[i].mfcb_refcnt++;
                ipst->ips_mfcs[i].mfcb_marks |= MFCB_MARK_CONDEMNED;
                mutex_exit(&ipst->ips_mfcs[i].mfcb_lock);
                mfc_rt = ipst->ips_mfcs[i].mfcb_mfc;
                while (mfc_rt) {
                        /* Free upcalls */
                        mutex_enter(&mfc_rt->mfc_mutex);
                        if (mfc_rt->mfc_rte != NULL) {
                                if (mfc_rt->mfc_timeout_id != 0) {
                                        /*
                                         * OK to drop the lock as we have
                                         * a refcnt on the bucket. timeout
                                         * can fire but it will see that
                                         * mfc_timeout_id == 0 and not do
                                         * anything. see expire_upcalls().
                                         */
                                        mfc_rt->mfc_timeout_id = 0;
                                        mutex_exit(&mfc_rt->mfc_mutex);
                                        (void) untimeout(
                                            mfc_rt->mfc_timeout_id);
                                                mfc_rt->mfc_timeout_id = 0;
                                        mutex_enter(&mfc_rt->mfc_mutex);

                                        /*
                                         * all queued upcall packets
                                         * and mblk will be freed in
                                         * release_mfc().
                                         */
                                }
                        }

                        mfc_rt->mfc_marks |= MFCB_MARK_CONDEMNED;

                        mutex_exit(&mfc_rt->mfc_mutex);
                        mfc_rt = mfc_rt->mfc_next;
                }
                MFCB_REFRELE(&ipst->ips_mfcs[i]);
        }

        mutex_enter(&ipst->ips_ip_g_mrouter_mutex);
        ipst->ips_ip_g_mrouter = NULL;
        mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
        return (0);
}

void
ip_mrouter_stack_destroy(ip_stack_t *ipst)
{
        struct mfcb *mfcbp;
        struct mfc  *rt;
        int i;

        for (i = 0; i < MFCTBLSIZ; i++) {
                mfcbp = &ipst->ips_mfcs[i];

                while ((rt = mfcbp->mfcb_mfc) != NULL) {
                        (void) printf("ip_mrouter_stack_destroy: free for %d\n",
                            i);

                        mfcbp->mfcb_mfc = rt->mfc_next;
                        free_queue(rt);
                        mi_free(rt);
                }
        }
        kmem_free(ipst->ips_vifs, sizeof (struct vif) * (MAXVIFS+1));
        ipst->ips_vifs = NULL;
        kmem_free(ipst->ips_mrtstat, sizeof (struct mrtstat));
        ipst->ips_mrtstat = NULL;
        kmem_free(ipst->ips_mfcs, sizeof (struct mfcb) * MFCTBLSIZ);
        ipst->ips_mfcs = NULL;
        kmem_free(ipst->ips_tbfs, sizeof (struct tbf) * MAXVIFS);
        ipst->ips_tbfs = NULL;

        mutex_destroy(&ipst->ips_last_encap_lock);
        mutex_destroy(&ipst->ips_ip_g_mrouter_mutex);
}

static boolean_t
is_mrouter_off(ip_stack_t *ipst)
{
        conn_t  *mrouter;

        mutex_enter(&ipst->ips_ip_g_mrouter_mutex);
        if (ipst->ips_ip_g_mrouter == NULL) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (B_TRUE);
        }

        mrouter = ipst->ips_ip_g_mrouter;
        if (mrouter->conn_multi_router == 0) {
                mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
                return (B_TRUE);
        }
        mutex_exit(&ipst->ips_ip_g_mrouter_mutex);
        return (B_FALSE);
}

static void
unlock_good_vif(struct vif *vifp)
{
        ASSERT(vifp->v_ipif != NULL);
        ipif_refrele(vifp->v_ipif);
        VIF_REFRELE(vifp);
}

static boolean_t
lock_good_vif(struct vif *vifp)
{
        mutex_enter(&vifp->v_lock);
        if (!(vifp->v_marks & VIF_MARK_GOOD)) {
                mutex_exit(&vifp->v_lock);
                return (B_FALSE);
        }

        ASSERT(vifp->v_ipif != NULL);
        mutex_enter(&vifp->v_ipif->ipif_ill->ill_lock);
        if (!IPIF_CAN_LOOKUP(vifp->v_ipif)) {
                mutex_exit(&vifp->v_ipif->ipif_ill->ill_lock);
                mutex_exit(&vifp->v_lock);
                return (B_FALSE);
        }
        ipif_refhold_locked(vifp->v_ipif);
        mutex_exit(&vifp->v_ipif->ipif_ill->ill_lock);
        vifp->v_refcnt++;
        mutex_exit(&vifp->v_lock);
        return (B_TRUE);
}

/*
 * Add a vif to the vif table.
 */
static int
add_vif(struct vifctl *vifcp, conn_t *connp, ip_stack_t *ipst)
{
        struct vif      *vifp = ipst->ips_vifs + vifcp->vifc_vifi;
        ipif_t          *ipif;
        int             error = 0;
        struct tbf      *v_tbf = ipst->ips_tbfs + vifcp->vifc_vifi;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        ilm_t           *ilm;
        ill_t           *ill;

        ASSERT(connp != NULL);

        if (vifcp->vifc_vifi >= MAXVIFS)
                return (EINVAL);

        if (is_mrouter_off(ipst))
                return (EINVAL);

        mutex_enter(&vifp->v_lock);
        /*
         * Viftable entry should be 0.
         * if v_marks == 0 but v_refcnt != 0 means struct is being
         * initialized.
         *
         * Also note that it is very unlikely that we will get a MRT_ADD_VIF
         * request while the delete is in progress, mrouted only sends add
         * requests when a new interface is added and the new interface cannot
         * have the same vifi as an existing interface. We make sure that
         * ill_delete will block till the vif is deleted by adding a refcnt
         * to ipif in del_vif().
         */
        if (vifp->v_lcl_addr.s_addr != 0 ||
            vifp->v_marks != 0 ||
            vifp->v_refcnt != 0) {
                mutex_exit(&vifp->v_lock);
                return (EADDRINUSE);
        }

        /* Incoming vif should not be 0 */
        if (vifcp->vifc_lcl_addr.s_addr == 0) {
                mutex_exit(&vifp->v_lock);
                return (EINVAL);
        }

        vifp->v_refcnt++;
        mutex_exit(&vifp->v_lock);
        /* Find the interface with the local address */
        ipif = ipif_lookup_addr((ipaddr_t)vifcp->vifc_lcl_addr.s_addr, NULL,
            IPCL_ZONEID(connp), ipst);
        if (ipif == NULL) {
                VIF_REFRELE(vifp);
                return (EADDRNOTAVAIL);
        }

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "add_vif: src 0x%x enter",
                    vifcp->vifc_lcl_addr.s_addr);
        }

        mutex_enter(&vifp->v_lock);
        /*
         * Always clear cache when vifs change.
         * Needed to ensure that src isn't left over from before vif was added.
         * No need to get last_encap_lock, since we are running as a writer.
         */

        mutex_enter(&ipst->ips_last_encap_lock);
        ipst->ips_last_encap_src = 0;
        ipst->ips_last_encap_vif = NULL;
        mutex_exit(&ipst->ips_last_encap_lock);

        if (vifcp->vifc_flags & VIFF_TUNNEL) {
                if ((vifcp->vifc_flags & VIFF_SRCRT) != 0) {
                        cmn_err(CE_WARN,
                            "add_vif: source route tunnels not supported\n");
                        VIF_REFRELE_LOCKED(vifp);
                        ipif_refrele(ipif);
                        return (EOPNOTSUPP);
                }
                vifp->v_rmt_addr  = vifcp->vifc_rmt_addr;

        } else {
                /* Phyint or Register vif */
                if (vifcp->vifc_flags & VIFF_REGISTER) {
                        /*
                         * Note: Since all IPPROTO_IP level options (including
                         * MRT_ADD_VIF) are done exclusively via
                         * ip_optmgmt_writer(), a lock is not necessary to
                         * protect reg_vif_num.
                         */
                        mutex_enter(&ipst->ips_numvifs_mutex);
                        if (ipst->ips_reg_vif_num == ALL_VIFS) {
                                ipst->ips_reg_vif_num = vifcp->vifc_vifi;
                                mutex_exit(&ipst->ips_numvifs_mutex);
                        } else {
                                mutex_exit(&ipst->ips_numvifs_mutex);
                                VIF_REFRELE_LOCKED(vifp);
                                ipif_refrele(ipif);
                                return (EADDRINUSE);
                        }
                }

                /* Make sure the interface supports multicast */
                if ((ipif->ipif_ill->ill_flags & ILLF_MULTICAST) == 0) {
                        VIF_REFRELE_LOCKED(vifp);
                        ipif_refrele(ipif);
                        if (vifcp->vifc_flags & VIFF_REGISTER) {
                                mutex_enter(&ipst->ips_numvifs_mutex);
                                ipst->ips_reg_vif_num = ALL_VIFS;
                                mutex_exit(&ipst->ips_numvifs_mutex);
                        }
                        return (EOPNOTSUPP);
                }
                /* Enable promiscuous reception of all IP mcasts from the if */
                mutex_exit(&vifp->v_lock);

                ill = ipif->ipif_ill;
                if (IS_UNDER_IPMP(ill))
                        ill = ipmp_ill_hold_ipmp_ill(ill);

                if (ill == NULL) {
                        ilm = NULL;
                } else {
                        ilm = ip_addmulti(&ipv6_all_zeros, ill,
                            ipif->ipif_zoneid, &error);
                        if (ilm != NULL)
                                atomic_inc_32(&ill->ill_mrouter_cnt);
                        if (IS_UNDER_IPMP(ipif->ipif_ill)) {
                                ill_refrele(ill);
                                ill = ipif->ipif_ill;
                        }
                }

                mutex_enter(&vifp->v_lock);
                /*
                 * since we released the lock lets make sure that
                 * ip_mrouter_done() has not been called.
                 */
                if (ilm == NULL || is_mrouter_off(ipst)) {
                        if (ilm != NULL) {
                                (void) ip_delmulti(ilm);
                                ASSERT(ill->ill_mrouter_cnt > 0);
                                atomic_dec_32(&ill->ill_mrouter_cnt);
                        }
                        if (vifcp->vifc_flags & VIFF_REGISTER) {
                                mutex_enter(&ipst->ips_numvifs_mutex);
                                ipst->ips_reg_vif_num = ALL_VIFS;
                                mutex_exit(&ipst->ips_numvifs_mutex);
                        }
                        VIF_REFRELE_LOCKED(vifp);
                        ipif_refrele(ipif);
                        return (error?error:EINVAL);
                }
                vifp->v_ilm = ilm;
        }
        /* Define parameters for the tbf structure */
        vifp->v_tbf = v_tbf;
        gethrestime(&vifp->v_tbf->tbf_last_pkt_t);
        vifp->v_tbf->tbf_n_tok = 0;
        vifp->v_tbf->tbf_q_len = 0;
        vifp->v_tbf->tbf_max_q_len = MAXQSIZE;
        vifp->v_tbf->tbf_q = vifp->v_tbf->tbf_t = NULL;

        vifp->v_flags = vifcp->vifc_flags;
        vifp->v_threshold = vifcp->vifc_threshold;
        vifp->v_lcl_addr = vifcp->vifc_lcl_addr;
        vifp->v_ipif = ipif;
        ipif_refrele(ipif);
        /* Scaling up here, allows division by 1024 in critical code.   */
        vifp->v_rate_limit = vifcp->vifc_rate_limit * (1024/1000);
        vifp->v_timeout_id = 0;
        /* initialize per vif pkt counters */
        vifp->v_pkt_in = 0;
        vifp->v_pkt_out = 0;
        vifp->v_bytes_in = 0;
        vifp->v_bytes_out = 0;
        mutex_init(&vifp->v_tbf->tbf_lock, NULL, MUTEX_DEFAULT, NULL);

        /* Adjust numvifs up, if the vifi is higher than numvifs */
        mutex_enter(&ipst->ips_numvifs_mutex);
        if (ipst->ips_numvifs <= vifcp->vifc_vifi)
                ipst->ips_numvifs = vifcp->vifc_vifi + 1;
        mutex_exit(&ipst->ips_numvifs_mutex);

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "add_vif: #%d, lcladdr %x, %s %x, thresh %x, rate %d",
                    vifcp->vifc_vifi,
                    ntohl(vifcp->vifc_lcl_addr.s_addr),
                    (vifcp->vifc_flags & VIFF_TUNNEL) ? "rmtaddr" : "mask",
                    ntohl(vifcp->vifc_rmt_addr.s_addr),
                    vifcp->vifc_threshold, vifcp->vifc_rate_limit);
        }

        vifp->v_marks = VIF_MARK_GOOD;
        mutex_exit(&vifp->v_lock);
        return (0);
}


/* Delete a vif from the vif table. */
static void
del_vifp(struct vif *vifp)
{
        struct tbf      *t = vifp->v_tbf;
        mblk_t  *mp0;
        vifi_t  vifi;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        ASSERT(vifp->v_marks & VIF_MARK_CONDEMNED);
        ASSERT(t != NULL);

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "del_vif: src 0x%x\n", vifp->v_lcl_addr.s_addr);
        }

        if (vifp->v_timeout_id != 0) {
                (void) untimeout(vifp->v_timeout_id);
                vifp->v_timeout_id = 0;
        }

        /*
         * Free packets queued at the interface.
         * Mrouted takes care of cleaning up mfcs - makes calls to del_mfc.
         */
        mutex_enter(&t->tbf_lock);
        while (t->tbf_q != NULL) {
                mp0 = t->tbf_q;
                t->tbf_q = t->tbf_q->b_next;
                mp0->b_prev = mp0->b_next = NULL;
                freemsg(mp0);
        }
        mutex_exit(&t->tbf_lock);

        /*
         * Always clear cache when vifs change.
         * No need to get last_encap_lock since we are running as a writer.
         */
        mutex_enter(&ipst->ips_last_encap_lock);
        if (vifp == ipst->ips_last_encap_vif) {
                ipst->ips_last_encap_vif = NULL;
                ipst->ips_last_encap_src = 0;
        }
        mutex_exit(&ipst->ips_last_encap_lock);

        mutex_destroy(&t->tbf_lock);

        bzero(vifp->v_tbf, sizeof (*(vifp->v_tbf)));

        /* Adjust numvifs down */
        mutex_enter(&ipst->ips_numvifs_mutex);
        for (vifi = ipst->ips_numvifs; vifi != 0; vifi--) /* vifi is unsigned */
                if (ipst->ips_vifs[vifi - 1].v_lcl_addr.s_addr != 0)
                        break;
        ipst->ips_numvifs = vifi;
        mutex_exit(&ipst->ips_numvifs_mutex);

        bzero(vifp, sizeof (*vifp));
}

static int
del_vif(vifi_t *vifip, ip_stack_t *ipst)
{
        struct vif      *vifp = ipst->ips_vifs + *vifip;

        if (*vifip >= ipst->ips_numvifs)
                return (EINVAL);

        mutex_enter(&vifp->v_lock);
        /*
         * Not initialized
         * Here we are not looking at the vif that is being initialized
         * i.e vifp->v_marks == 0 and refcnt > 0.
         */
        if (vifp->v_lcl_addr.s_addr == 0 ||
            !(vifp->v_marks & VIF_MARK_GOOD)) {
                mutex_exit(&vifp->v_lock);
                return (EADDRNOTAVAIL);
        }

        /* Clear VIF_MARK_GOOD and set VIF_MARK_CONDEMNED. */
        vifp->v_marks &= ~VIF_MARK_GOOD;
        vifp->v_marks |= VIF_MARK_CONDEMNED;

        /* Phyint only */
        if (!(vifp->v_flags & (VIFF_TUNNEL | VIFF_REGISTER))) {
                ipif_t *ipif = vifp->v_ipif;
                ilm_t *ilm = vifp->v_ilm;

                vifp->v_ilm = NULL;

                ASSERT(ipif != NULL);
                /*
                 * should be OK to drop the lock as we
                 * have marked this as CONDEMNED.
                 */
                mutex_exit(&(vifp)->v_lock);
                if (ilm != NULL) {
                        (void) ip_delmulti(ilm);
                        ASSERT(ipif->ipif_ill->ill_mrouter_cnt > 0);
                        atomic_dec_32(&ipif->ipif_ill->ill_mrouter_cnt);
                }
                mutex_enter(&(vifp)->v_lock);
        }

        if (vifp->v_flags & VIFF_REGISTER) {
                mutex_enter(&ipst->ips_numvifs_mutex);
                ipst->ips_reg_vif_num = ALL_VIFS;
                mutex_exit(&ipst->ips_numvifs_mutex);
        }

        /*
         * decreases the refcnt added in add_vif.
         */
        VIF_REFRELE_LOCKED(vifp);
        return (0);
}

/*
 * Add an mfc entry.
 */
static int
add_mfc(struct mfcctl *mfccp, ip_stack_t *ipst)
{
        struct mfc *rt;
        struct rtdetq *rte;
        ushort_t nstl;
        int i;
        struct mfcb *mfcbp;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /*
         * The value of vifi is NO_VIF (==MAXVIFS) if Mrouted
         * did not have a real route for pkt.
         * We want this pkt without rt installed in the mfctable to prevent
         * multiiple tries, so go ahead and put it in mfctable, it will
         * be discarded later in ip_mdq() because the child is NULL.
         */

        /* Error checking, out of bounds? */
        if (mfccp->mfcc_parent > MAXVIFS) {
                ip0dbg(("ADD_MFC: mfcc_parent out of range %d",
                    (int)mfccp->mfcc_parent));
                return (EINVAL);
        }

        if ((mfccp->mfcc_parent != NO_VIF) &&
            (ipst->ips_vifs[mfccp->mfcc_parent].v_ipif == NULL)) {
                ip0dbg(("ADD_MFC: NULL ipif for parent vif %d\n",
                    (int)mfccp->mfcc_parent));
                return (EINVAL);
        }

        if (is_mrouter_off(ipst)) {
                return (EINVAL);
        }

        mfcbp = &ipst->ips_mfcs[MFCHASH(mfccp->mfcc_origin.s_addr,
            mfccp->mfcc_mcastgrp.s_addr)];
        MFCB_REFHOLD(mfcbp);
        MFCFIND(mfcbp, mfccp->mfcc_origin.s_addr,
            mfccp->mfcc_mcastgrp.s_addr, rt);

        /* If an entry already exists, just update the fields */
        if (rt) {
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "add_mfc: update o %x grp %x parent %x",
                            ntohl(mfccp->mfcc_origin.s_addr),
                            ntohl(mfccp->mfcc_mcastgrp.s_addr),
                            mfccp->mfcc_parent);
                }
                mutex_enter(&rt->mfc_mutex);
                rt->mfc_parent = mfccp->mfcc_parent;

                mutex_enter(&ipst->ips_numvifs_mutex);
                for (i = 0; i < (int)ipst->ips_numvifs; i++)
                        rt->mfc_ttls[i] = mfccp->mfcc_ttls[i];
                mutex_exit(&ipst->ips_numvifs_mutex);
                mutex_exit(&rt->mfc_mutex);

                MFCB_REFRELE(mfcbp);
                return (0);
        }

        /*
         * Find the entry for which the upcall was made and update.
         */
        for (rt = mfcbp->mfcb_mfc, nstl = 0; rt; rt = rt->mfc_next) {
                mutex_enter(&rt->mfc_mutex);
                if ((rt->mfc_origin.s_addr == mfccp->mfcc_origin.s_addr) &&
                    (rt->mfc_mcastgrp.s_addr == mfccp->mfcc_mcastgrp.s_addr) &&
                    (rt->mfc_rte != NULL) &&
                    !(rt->mfc_marks & MFCB_MARK_CONDEMNED)) {
                        if (nstl++ != 0)
                                cmn_err(CE_WARN,
                                    "add_mfc: %s o %x g %x p %x",
                                    "multiple kernel entries",
                                    ntohl(mfccp->mfcc_origin.s_addr),
                                    ntohl(mfccp->mfcc_mcastgrp.s_addr),
                                    mfccp->mfcc_parent);

                        if (ipst->ips_ip_mrtdebug > 1) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "add_mfc: o %x g %x p %x",
                                    ntohl(mfccp->mfcc_origin.s_addr),
                                    ntohl(mfccp->mfcc_mcastgrp.s_addr),
                                    mfccp->mfcc_parent);
                        }
                        fill_route(rt, mfccp, ipst);

                        /*
                         * Prevent cleanup of cache entry.
                         * Timer starts in ip_mforward.
                         */
                        if (rt->mfc_timeout_id != 0) {
                                timeout_id_t id;
                                id = rt->mfc_timeout_id;
                                /*
                                 * setting id to zero will avoid this
                                 * entry from being cleaned up in
                                 * expire_up_calls().
                                 */
                                rt->mfc_timeout_id = 0;
                                /*
                                 * dropping the lock is fine as we
                                 * have a refhold on the bucket.
                                 * so mfc cannot be freed.
                                 * The timeout can fire but it will see
                                 * that mfc_timeout_id == 0 and not cleanup.
                                 */
                                mutex_exit(&rt->mfc_mutex);
                                (void) untimeout(id);
                                mutex_enter(&rt->mfc_mutex);
                        }

                        /*
                         * Send all pkts that are queued waiting for the upcall.
                         * ip_mdq param tun set to 0 -
                         * the return value of ip_mdq() isn't used here,
                         * so value we send doesn't matter.
                         */
                        while (rt->mfc_rte != NULL) {
                                rte = rt->mfc_rte;
                                rt->mfc_rte = rte->rte_next;
                                mutex_exit(&rt->mfc_mutex);
                                (void) ip_mdq(rte->mp, (ipha_t *)
                                    rte->mp->b_rptr, rte->ill, 0, rt);
                                freemsg(rte->mp);
                                mi_free((char *)rte);
                                mutex_enter(&rt->mfc_mutex);
                        }
                }
                mutex_exit(&rt->mfc_mutex);
        }


        /*
         * It is possible that an entry is being inserted without an upcall
         */
        if (nstl == 0) {
                mutex_enter(&(mfcbp->mfcb_lock));
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "add_mfc: no upcall o %x g %x p %x",
                            ntohl(mfccp->mfcc_origin.s_addr),
                            ntohl(mfccp->mfcc_mcastgrp.s_addr),
                            mfccp->mfcc_parent);
                }
                if (is_mrouter_off(ipst)) {
                        mutex_exit(&mfcbp->mfcb_lock);
                        MFCB_REFRELE(mfcbp);
                        return (EINVAL);
                }

                for (rt = mfcbp->mfcb_mfc; rt; rt = rt->mfc_next) {

                        mutex_enter(&rt->mfc_mutex);
                        if ((rt->mfc_origin.s_addr ==
                            mfccp->mfcc_origin.s_addr) &&
                            (rt->mfc_mcastgrp.s_addr ==
                            mfccp->mfcc_mcastgrp.s_addr) &&
                            (!(rt->mfc_marks & MFCB_MARK_CONDEMNED))) {
                                fill_route(rt, mfccp, ipst);
                                mutex_exit(&rt->mfc_mutex);
                                break;
                        }
                        mutex_exit(&rt->mfc_mutex);
                }

                /* No upcall, so make a new entry into mfctable */
                if (rt == NULL) {
                        rt = (struct mfc *)mi_zalloc(sizeof (struct mfc));
                        if (rt == NULL) {
                                ip1dbg(("add_mfc: out of memory\n"));
                                mutex_exit(&mfcbp->mfcb_lock);
                                MFCB_REFRELE(mfcbp);
                                return (ENOBUFS);
                        }

                        /* Insert new entry at head of hash chain */
                        mutex_enter(&rt->mfc_mutex);
                        fill_route(rt, mfccp, ipst);

                        /* Link into table */
                        rt->mfc_next   = mfcbp->mfcb_mfc;
                        mfcbp->mfcb_mfc = rt;
                        mutex_exit(&rt->mfc_mutex);
                }
                mutex_exit(&mfcbp->mfcb_lock);
        }

        MFCB_REFRELE(mfcbp);
        return (0);
}

/*
 * Fills in mfc structure from mrouted mfcctl.
 */
static void
fill_route(struct mfc *rt, struct mfcctl *mfccp, ip_stack_t *ipst)
{
        int i;

        rt->mfc_origin          = mfccp->mfcc_origin;
        rt->mfc_mcastgrp        = mfccp->mfcc_mcastgrp;
        rt->mfc_parent          = mfccp->mfcc_parent;
        mutex_enter(&ipst->ips_numvifs_mutex);
        for (i = 0; i < (int)ipst->ips_numvifs; i++) {
                rt->mfc_ttls[i] = mfccp->mfcc_ttls[i];
        }
        mutex_exit(&ipst->ips_numvifs_mutex);
        /* Initialize pkt counters per src-grp */
        rt->mfc_pkt_cnt = 0;
        rt->mfc_byte_cnt        = 0;
        rt->mfc_wrong_if        = 0;
        rt->mfc_last_assert.tv_sec = rt->mfc_last_assert.tv_nsec = 0;

}

static void
free_queue(struct mfc *mfcp)
{
        struct rtdetq *rte0;

        /*
         * Drop all queued upcall packets.
         * Free the mbuf with the pkt.
         */
        while ((rte0 = mfcp->mfc_rte) != NULL) {
                mfcp->mfc_rte = rte0->rte_next;
                freemsg(rte0->mp);
                mi_free((char *)rte0);
        }
}
/*
 * go thorugh the hash bucket and free all the entries marked condemned.
 */
void
release_mfc(struct mfcb *mfcbp)
{
        struct mfc *current_mfcp;
        struct mfc *prev_mfcp;

        prev_mfcp = current_mfcp = mfcbp->mfcb_mfc;

        while (current_mfcp != NULL) {
                if (current_mfcp->mfc_marks & MFCB_MARK_CONDEMNED) {
                        if (current_mfcp == mfcbp->mfcb_mfc) {
                                mfcbp->mfcb_mfc = current_mfcp->mfc_next;
                                free_queue(current_mfcp);
                                mi_free(current_mfcp);
                                prev_mfcp = current_mfcp = mfcbp->mfcb_mfc;
                                continue;
                        }
                        ASSERT(prev_mfcp != NULL);
                        prev_mfcp->mfc_next = current_mfcp->mfc_next;
                        free_queue(current_mfcp);
                        mi_free(current_mfcp);
                        current_mfcp = NULL;
                } else {
                        prev_mfcp = current_mfcp;
                }

                current_mfcp = prev_mfcp->mfc_next;

        }
        mfcbp->mfcb_marks &= ~MFCB_MARK_CONDEMNED;
        ASSERT(mfcbp->mfcb_mfc != NULL || mfcbp->mfcb_marks == 0);
}

/*
 * Delete an mfc entry.
 */
static int
del_mfc(struct mfcctl *mfccp, ip_stack_t *ipst)
{
        struct in_addr  origin;
        struct in_addr  mcastgrp;
        struct mfc      *rt;
        uint_t          hash;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        origin = mfccp->mfcc_origin;
        mcastgrp = mfccp->mfcc_mcastgrp;
        hash = MFCHASH(origin.s_addr, mcastgrp.s_addr);

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "del_mfc: o %x g %x",
                    ntohl(origin.s_addr),
                    ntohl(mcastgrp.s_addr));
        }

        MFCB_REFHOLD(&ipst->ips_mfcs[hash]);

        /* Find mfc in mfctable, finds only entries without upcalls */
        for (rt = ipst->ips_mfcs[hash].mfcb_mfc; rt; rt = rt->mfc_next) {
                mutex_enter(&rt->mfc_mutex);
                if (origin.s_addr == rt->mfc_origin.s_addr &&
                    mcastgrp.s_addr == rt->mfc_mcastgrp.s_addr &&
                    rt->mfc_rte == NULL &&
                    !(rt->mfc_marks & MFCB_MARK_CONDEMNED))
                        break;
                mutex_exit(&rt->mfc_mutex);
        }

        /*
         * Return if there was an upcall (mfc_rte != NULL,
         * or rt not in mfctable.
         */
        if (rt == NULL) {
                MFCB_REFRELE(&ipst->ips_mfcs[hash]);
                return (EADDRNOTAVAIL);
        }


        /*
         * no need to hold lock as we have a reference.
         */
        ipst->ips_mfcs[hash].mfcb_marks |= MFCB_MARK_CONDEMNED;
        /* error checking */
        if (rt->mfc_timeout_id != 0) {
                ip0dbg(("del_mfc: TIMEOUT NOT 0, rte not null"));
                /*
                 * Its ok to drop the lock,  the struct cannot be freed
                 * since we have a ref on the hash bucket.
                 */
                rt->mfc_timeout_id = 0;
                mutex_exit(&rt->mfc_mutex);
                (void) untimeout(rt->mfc_timeout_id);
                mutex_enter(&rt->mfc_mutex);
        }

        ASSERT(rt->mfc_rte == NULL);


        /*
         * Delete the entry from the cache
         */
        rt->mfc_marks |= MFCB_MARK_CONDEMNED;
        mutex_exit(&rt->mfc_mutex);

        MFCB_REFRELE(&ipst->ips_mfcs[hash]);

        return (0);
}

#define TUNNEL_LEN  12  /* # bytes of IP option for tunnel encapsulation  */

/*
 * IP multicast forwarding function. This function assumes that the packet
 * pointed to by ipha has arrived on (or is about to be sent to) the interface
 * pointed to by "ill", and the packet is to be relayed to other networks
 * that have members of the packet's destination IP multicast group.
 *
 * The packet is returned unscathed to the caller, unless it is
 * erroneous, in which case a -1 value tells the caller (IP)
 * to discard it.
 *
 * Unlike BSD, SunOS 5.x needs to return to IP info about
 * whether pkt came in thru a tunnel, so it can be discarded, unless
 * it's IGMP. In BSD, the ifp is bogus for tunnels, so pkt won't try
 * to be delivered.
 * Return values are 0 - pkt is okay and phyint
 *                  -1 - pkt is malformed and to be tossed
 *                   1 - pkt came in on tunnel
 */
int
ip_mforward(mblk_t *mp, ip_recv_attr_t *ira)
{
        ipha_t          *ipha = (ipha_t *)mp->b_rptr;
        ill_t           *ill = ira->ira_ill;
        struct mfc      *rt;
        ipaddr_t        src, dst, tunnel_src = 0;
        static int      srctun = 0;
        vifi_t          vifi;
        boolean_t       pim_reg_packet = B_FALSE;
        struct mfcb     *mfcbp;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        ill_t           *rill = ira->ira_rill;

        ASSERT(ira->ira_pktlen == msgdsize(mp));

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "ip_mforward: RECV ipha_src %x, ipha_dst %x, ill %s",
                    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst),
                    ill->ill_name);
        }

        dst = ipha->ipha_dst;
        if (ira->ira_flags & IRAF_PIM_REGISTER)
                pim_reg_packet = B_TRUE;
        else if (ira->ira_flags & IRAF_MROUTE_TUNNEL_SET)
                tunnel_src = ira->ira_mroute_tunnel;

        /*
         * Don't forward a packet with time-to-live of zero or one,
         * or a packet destined to a local-only group.
         */
        if (CLASSD(dst) && (ipha->ipha_ttl <= 1 ||
            (ipaddr_t)ntohl(dst) <= INADDR_MAX_LOCAL_GROUP)) {
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mforward: not forwarded ttl %d,"
                            " dst 0x%x ill %s",
                            ipha->ipha_ttl, ntohl(dst), ill->ill_name);
                }
                if (tunnel_src != 0)
                        return (1);
                else
                        return (0);
        }

        if ((tunnel_src != 0) || pim_reg_packet) {
                /*
                 * Packet arrived over an encapsulated tunnel or via a PIM
                 * register message.
                 */
                if (ipst->ips_ip_mrtdebug > 1) {
                        if (tunnel_src != 0) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "ip_mforward: ill %s arrived via ENCAP TUN",
                                    ill->ill_name);
                        } else if (pim_reg_packet) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "ip_mforward: ill %s arrived via"
                                    "  REGISTER VIF",
                                    ill->ill_name);
                        }
                }
        } else if ((ipha->ipha_version_and_hdr_length & 0xf) <
            (uint_t)(IP_SIMPLE_HDR_LENGTH + TUNNEL_LEN) >> 2 ||
            ((uchar_t *)(ipha + 1))[1] != IPOPT_LSRR) {
                /* Packet arrived via a physical interface. */
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mforward: ill %s arrived via PHYINT",
                            ill->ill_name);
                }

        } else {
                /*
                 * Packet arrived through a SRCRT tunnel.
                 * Source-route tunnels are no longer supported.
                 * Error message printed every 1000 times.
                 */
                if ((srctun++ % 1000) == 0) {
                        cmn_err(CE_WARN,
                            "ip_mforward: received source-routed pkt from %x",
                            ntohl(ipha->ipha_src));
                }
                return (-1);
        }

        ipst->ips_mrtstat->mrts_fwd_in++;
        src = ipha->ipha_src;

        /* Find route in cache, return NULL if not there or upcalls q'ed. */

        /*
         * Lock the mfctable against changes made by ip_mforward.
         * Note that only add_mfc and del_mfc can remove entries and
         * they run with exclusive access to IP. So we do not need to
         * guard against the rt being deleted, so release lock after reading.
         */

        if (is_mrouter_off(ipst))
                return (-1);

        mfcbp = &ipst->ips_mfcs[MFCHASH(src, dst)];
        MFCB_REFHOLD(mfcbp);
        MFCFIND(mfcbp, src, dst, rt);

        /* Entry exists, so forward if necessary */
        if (rt != NULL) {
                int ret = 0;
                ipst->ips_mrtstat->mrts_mfc_hits++;
                if (pim_reg_packet) {
                        ASSERT(ipst->ips_reg_vif_num != ALL_VIFS);
                        ret = ip_mdq(mp, ipha,
                            ipst->ips_vifs[ipst->ips_reg_vif_num].
                            v_ipif->ipif_ill,
                            0, rt);
                } else {
                        ret = ip_mdq(mp, ipha, ill, tunnel_src, rt);
                }

                MFCB_REFRELE(mfcbp);
                return (ret);

                /*
                 * Don't forward if we don't have a cache entry.  Mrouted will
                 * always provide a cache entry in response to an upcall.
                 */
        } else {
                /*
                 * If we don't have a route for packet's origin, make a copy
                 * of the packet and send message to routing daemon.
                 */
                struct mfc      *mfc_rt  = NULL;
                mblk_t          *mp0     = NULL;
                mblk_t          *mp_copy = NULL;
                struct rtdetq   *rte     = NULL;
                struct rtdetq   *rte_m, *rte1, *prev_rte;
                uint_t          hash;
                int             npkts;
                boolean_t       new_mfc = B_FALSE;
                ipst->ips_mrtstat->mrts_mfc_misses++;
                /* BSD uses mrts_no_route++ */
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mforward: no rte ill %s src %x g %x misses %d",
                            ill->ill_name, ntohl(src), ntohl(dst),
                            (int)ipst->ips_mrtstat->mrts_mfc_misses);
                }
                /*
                 * The order of the following code differs from the BSD code.
                 * Pre-mc3.5, the BSD code was incorrect and SunOS 5.x
                 * code works, so SunOS 5.x wasn't changed to conform to the
                 * BSD version.
                 */

                /* Lock mfctable. */
                hash = MFCHASH(src, dst);
                mutex_enter(&(ipst->ips_mfcs[hash].mfcb_lock));

                /*
                 * If we are turning off mrouted return an error
                 */
                if (is_mrouter_off(ipst)) {
                        mutex_exit(&mfcbp->mfcb_lock);
                        MFCB_REFRELE(mfcbp);
                        return (-1);
                }

                /* Is there an upcall waiting for this packet? */
                for (mfc_rt = ipst->ips_mfcs[hash].mfcb_mfc; mfc_rt;
                    mfc_rt = mfc_rt->mfc_next) {
                        mutex_enter(&mfc_rt->mfc_mutex);
                        if (ipst->ips_ip_mrtdebug > 1) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "ip_mforward: MFCTAB hash %d o 0x%x"
                                    " g 0x%x\n",
                                    hash, ntohl(mfc_rt->mfc_origin.s_addr),
                                    ntohl(mfc_rt->mfc_mcastgrp.s_addr));
                        }
                        /* There is an upcall */
                        if ((src == mfc_rt->mfc_origin.s_addr) &&
                            (dst == mfc_rt->mfc_mcastgrp.s_addr) &&
                            (mfc_rt->mfc_rte != NULL) &&
                            !(mfc_rt->mfc_marks & MFCB_MARK_CONDEMNED)) {
                                break;
                        }
                        mutex_exit(&mfc_rt->mfc_mutex);
                }
                /* No upcall, so make a new entry into mfctable */
                if (mfc_rt == NULL) {
                        mfc_rt = (struct mfc *)mi_zalloc(sizeof (struct mfc));
                        if (mfc_rt == NULL) {
                                ipst->ips_mrtstat->mrts_fwd_drop++;
                                ip1dbg(("ip_mforward: out of memory "
                                    "for mfc, mfc_rt\n"));
                                goto error_return;
                        } else
                                new_mfc = B_TRUE;
                        /* Get resources */
                        /* TODO could copy header and dup rest */
                        mp_copy = copymsg(mp);
                        if (mp_copy == NULL) {
                                ipst->ips_mrtstat->mrts_fwd_drop++;
                                ip1dbg(("ip_mforward: out of memory for "
                                    "mblk, mp_copy\n"));
                                goto error_return;
                        }
                        mutex_enter(&mfc_rt->mfc_mutex);
                }
                /* Get resources for rte, whether first rte or not first. */
                /* Add this packet into rtdetq */
                rte = (struct rtdetq *)mi_zalloc(sizeof (struct rtdetq));
                if (rte == NULL) {
                        ipst->ips_mrtstat->mrts_fwd_drop++;
                        mutex_exit(&mfc_rt->mfc_mutex);
                        ip1dbg(("ip_mforward: out of memory for"
                            " rtdetq, rte\n"));
                        goto error_return;
                }

                mp0 = copymsg(mp);
                if (mp0 == NULL) {
                        ipst->ips_mrtstat->mrts_fwd_drop++;
                        ip1dbg(("ip_mforward: out of memory for mblk, mp0\n"));
                        mutex_exit(&mfc_rt->mfc_mutex);
                        goto error_return;
                }
                rte->mp         = mp0;
                if (pim_reg_packet) {
                        ASSERT(ipst->ips_reg_vif_num != ALL_VIFS);
                        rte->ill =
                            ipst->ips_vifs[ipst->ips_reg_vif_num].
                            v_ipif->ipif_ill;
                } else {
                        rte->ill = ill;
                }
                rte->rte_next   = NULL;

                /*
                 * Determine if upcall q (rtdetq) has overflowed.
                 * mfc_rt->mfc_rte is null by mi_zalloc
                 * if it is the first message.
                 */
                for (rte_m = mfc_rt->mfc_rte, npkts = 0; rte_m;
                    rte_m = rte_m->rte_next)
                        npkts++;
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mforward: upcalls %d\n", npkts);
                }
                if (npkts > MAX_UPQ) {
                        ipst->ips_mrtstat->mrts_upq_ovflw++;
                        mutex_exit(&mfc_rt->mfc_mutex);
                        goto error_return;
                }

                if (npkts == 0) {       /* first upcall */
                        int i = 0;
                        /*
                         * Now finish installing the new mfc! Now that we have
                         * resources!  Insert new entry at head of hash chain.
                         * Use src and dst which are ipaddr_t's.
                         */
                        mfc_rt->mfc_origin.s_addr = src;
                        mfc_rt->mfc_mcastgrp.s_addr = dst;

                        mutex_enter(&ipst->ips_numvifs_mutex);
                        for (i = 0; i < (int)ipst->ips_numvifs; i++)
                                mfc_rt->mfc_ttls[i] = 0;
                        mutex_exit(&ipst->ips_numvifs_mutex);
                        mfc_rt->mfc_parent = ALL_VIFS;

                        /* Link into table */
                        if (ipst->ips_ip_mrtdebug > 1) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "ip_mforward: NEW MFCTAB hash %d o 0x%x "
                                    "g 0x%x\n", hash,
                                    ntohl(mfc_rt->mfc_origin.s_addr),
                                    ntohl(mfc_rt->mfc_mcastgrp.s_addr));
                        }
                        mfc_rt->mfc_next = ipst->ips_mfcs[hash].mfcb_mfc;
                        ipst->ips_mfcs[hash].mfcb_mfc = mfc_rt;
                        mfc_rt->mfc_rte = NULL;
                }

                /* Link in the upcall */
                /* First upcall */
                if (mfc_rt->mfc_rte == NULL)
                        mfc_rt->mfc_rte = rte;
                else {
                        /* not the first upcall */
                        prev_rte = mfc_rt->mfc_rte;
                        for (rte1 = mfc_rt->mfc_rte->rte_next; rte1;
                            prev_rte = rte1, rte1 = rte1->rte_next)
                                ;
                        prev_rte->rte_next = rte;
                }

                /*
                 * No upcalls waiting, this is first one, so send a message to
                 * routing daemon to install a route into kernel table.
                 */
                if (npkts == 0) {
                        struct igmpmsg  *im;
                        /* ipha_protocol is 0, for upcall */
                        ASSERT(mp_copy != NULL);
                        im = (struct igmpmsg *)mp_copy->b_rptr;
                        im->im_msgtype  = IGMPMSG_NOCACHE;
                        im->im_mbz = 0;
                        mutex_enter(&ipst->ips_numvifs_mutex);
                        if (pim_reg_packet) {
                                im->im_vif = (uchar_t)ipst->ips_reg_vif_num;
                                mutex_exit(&ipst->ips_numvifs_mutex);
                        } else {
                                /*
                                 * XXX do we need to hold locks here ?
                                 */
                                for (vifi = 0;
                                    vifi < ipst->ips_numvifs;
                                    vifi++) {
                                        if (ipst->ips_vifs[vifi].v_ipif == NULL)
                                                continue;
                                        if (ipst->ips_vifs[vifi].
                                            v_ipif->ipif_ill == ill) {
                                                im->im_vif = (uchar_t)vifi;
                                                break;
                                        }
                                }
                                mutex_exit(&ipst->ips_numvifs_mutex);
                                ASSERT(vifi < ipst->ips_numvifs);
                        }

                        ipst->ips_mrtstat->mrts_upcalls++;
                        /* Timer to discard upcalls if mrouted is too slow */
                        mfc_rt->mfc_timeout_id = timeout(expire_upcalls,
                            mfc_rt, EXPIRE_TIMEOUT * UPCALL_EXPIRE);
                        mutex_exit(&mfc_rt->mfc_mutex);
                        mutex_exit(&(ipst->ips_mfcs[hash].mfcb_lock));
                        /* Pass to RAWIP */
                        ira->ira_ill = ira->ira_rill = NULL;
                        (mrouter->conn_recv)(mrouter, mp_copy, NULL, ira);
                        ira->ira_ill = ill;
                        ira->ira_rill = rill;
                } else {
                        mutex_exit(&mfc_rt->mfc_mutex);
                        mutex_exit(&(ipst->ips_mfcs[hash].mfcb_lock));
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                        ip_drop_input("ip_mforward - upcall already waiting",
                            mp_copy, ill);
                        freemsg(mp_copy);
                }

                MFCB_REFRELE(mfcbp);
                if (tunnel_src != 0)
                        return (1);
                else
                        return (0);
        error_return:
                mutex_exit(&(ipst->ips_mfcs[hash].mfcb_lock));
                MFCB_REFRELE(mfcbp);
                if (mfc_rt != NULL && (new_mfc == B_TRUE))
                        mi_free((char *)mfc_rt);
                if (rte != NULL)
                        mi_free((char *)rte);
                if (mp_copy != NULL) {
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                        ip_drop_input("ip_mforward error", mp_copy, ill);
                        freemsg(mp_copy);
                }
                if (mp0 != NULL)
                        freemsg(mp0);
                return (-1);
        }
}

/*
 * Clean up the mfctable cache entry if upcall is not serviced.
 * SunOS 5.x has timeout per mfc, unlike BSD which has one timer.
 */
static void
expire_upcalls(void *arg)
{
        struct mfc *mfc_rt = arg;
        uint_t hash;
        struct mfc *prev_mfc, *mfc0;
        ip_stack_t      *ipst;
        conn_t          *mrouter;

        if (mfc_rt->mfc_rte == NULL || mfc_rt->mfc_rte->ill != NULL) {
                cmn_err(CE_WARN, "expire_upcalls: no ILL\n");
                return;
        }
        ipst = mfc_rt->mfc_rte->ill->ill_ipst;
        mrouter = ipst->ips_ip_g_mrouter;

        hash = MFCHASH(mfc_rt->mfc_origin.s_addr, mfc_rt->mfc_mcastgrp.s_addr);
        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "expire_upcalls: hash %d s %x g %x",
                    hash, ntohl(mfc_rt->mfc_origin.s_addr),
                    ntohl(mfc_rt->mfc_mcastgrp.s_addr));
        }
        MFCB_REFHOLD(&ipst->ips_mfcs[hash]);
        mutex_enter(&mfc_rt->mfc_mutex);
        /*
         * if timeout has been set to zero, than the
         * entry has been filled, no need to delete it.
         */
        if (mfc_rt->mfc_timeout_id == 0)
                goto done;
        ipst->ips_mrtstat->mrts_cache_cleanups++;
        mfc_rt->mfc_timeout_id = 0;

        /* Determine entry to be cleaned up in cache table. */
        for (prev_mfc = mfc0 = ipst->ips_mfcs[hash].mfcb_mfc; mfc0;
            prev_mfc = mfc0, mfc0 = mfc0->mfc_next)
                if (mfc0 == mfc_rt)
                        break;

        /* del_mfc takes care of gone mfcs */
        ASSERT(prev_mfc != NULL);
        ASSERT(mfc0 != NULL);

        /*
         * Delete the entry from the cache
         */
        ipst->ips_mfcs[hash].mfcb_marks |= MFCB_MARK_CONDEMNED;
        mfc_rt->mfc_marks |= MFCB_MARK_CONDEMNED;

        /*
         * release_mfc will drop all queued upcall packets.
         * and will free the mbuf with the pkt, if, timing info.
         */
done:
        mutex_exit(&mfc_rt->mfc_mutex);
        MFCB_REFRELE(&ipst->ips_mfcs[hash]);
}

/*
 * Packet forwarding routine once entry in the cache is made.
 */
static int
ip_mdq(mblk_t *mp, ipha_t *ipha, ill_t *ill, ipaddr_t tunnel_src,
    struct mfc *rt)
{
        vifi_t vifi;
        struct vif *vifp;
        ipaddr_t dst = ipha->ipha_dst;
        size_t  plen = msgdsize(mp);
        vifi_t num_of_vifs;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        ip_recv_attr_t  iras;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "ip_mdq: SEND src %x, ipha_dst %x, ill %s",
                    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst),
                    ill->ill_name);
        }

        /* Macro to send packet on vif */
#define MC_SEND(ipha, mp, vifp, dst) { \
        if ((vifp)->v_flags & VIFF_TUNNEL) \
                encap_send((ipha), (mp), (vifp), (dst)); \
        else if ((vifp)->v_flags & VIFF_REGISTER) \
                register_send((ipha), (mp), (vifp), (dst)); \
        else \
                phyint_send((ipha), (mp), (vifp), (dst)); \
}

        vifi = rt->mfc_parent;

        /*
         * The value of vifi is MAXVIFS if the pkt had no parent, i.e.,
         * Mrouted had no route.
         * We wanted the route installed in the mfctable to prevent multiple
         * tries, so it passed add_mfc(), but is discarded here. The v_ipif is
         * NULL so we don't want to check the ill. Still needed as of Mrouted
         * 3.6.
         */
        if (vifi == NO_VIF) {
                ip1dbg(("ip_mdq: no route for origin ill %s, vifi is NO_VIF\n",
                    ill->ill_name));
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mdq: vifi is NO_VIF ill = %s", ill->ill_name);
                }
                return (-1);    /* drop pkt */
        }

        if (!lock_good_vif(&ipst->ips_vifs[vifi]))
                return (-1);
        /*
         * The MFC entries are not cleaned up when an ipif goes
         * away thus this code has to guard against an MFC referencing
         * an ipif that has been closed. Note: reset_mrt_vif_ipif
         * sets the v_ipif to NULL when the ipif disappears.
         */
        ASSERT(ipst->ips_vifs[vifi].v_ipif != NULL);

        if (vifi >= ipst->ips_numvifs) {
                cmn_err(CE_WARN, "ip_mdq: illegal vifi %d numvifs "
                    "%d ill %s viftable ill %s\n",
                    (int)vifi, (int)ipst->ips_numvifs, ill->ill_name,
                    ipst->ips_vifs[vifi].v_ipif->ipif_ill->ill_name);
                unlock_good_vif(&ipst->ips_vifs[vifi]);
                return (-1);
        }
        /*
         * Don't forward if it didn't arrive from the parent vif for its
         * origin.
         */
        if ((ipst->ips_vifs[vifi].v_ipif->ipif_ill != ill) ||
            (ipst->ips_vifs[vifi].v_rmt_addr.s_addr != tunnel_src)) {
                /* Came in the wrong interface */
                ip1dbg(("ip_mdq: arrived wrong if, vifi %d "
                        "numvifs %d ill %s viftable ill %s\n",
                        (int)vifi, (int)ipst->ips_numvifs, ill->ill_name,
                        ipst->ips_vifs[vifi].v_ipif->ipif_ill->ill_name));
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "ip_mdq: arrived wrong if, vifi %d ill "
                            "%s viftable ill %s\n",
                            (int)vifi, ill->ill_name,
                            ipst->ips_vifs[vifi].v_ipif->ipif_ill->ill_name);
                }
                ipst->ips_mrtstat->mrts_wrong_if++;
                rt->mfc_wrong_if++;

                /*
                 * If we are doing PIM assert processing and we are forwarding
                 * packets on this interface, and it is a broadcast medium
                 * interface (and not a tunnel), send a message to the routing.
                 *
                 * We use the first ipif on the list, since it's all we have.
                 * Chances are the ipif_flags are the same for ipifs on the ill.
                 */
                if (ipst->ips_pim_assert && rt->mfc_ttls[vifi] > 0 &&
                    (ill->ill_ipif->ipif_flags & IPIF_BROADCAST) &&
                    !(ipst->ips_vifs[vifi].v_flags & VIFF_TUNNEL)) {
                        mblk_t          *mp_copy;
                        struct igmpmsg  *im;

                        /* TODO could copy header and dup rest */
                        mp_copy = copymsg(mp);
                        if (mp_copy == NULL) {
                                ipst->ips_mrtstat->mrts_fwd_drop++;
                                ip1dbg(("ip_mdq: out of memory "
                                    "for mblk, mp_copy\n"));
                                unlock_good_vif(&ipst->ips_vifs[vifi]);
                                return (-1);
                        }

                        im = (struct igmpmsg *)mp_copy->b_rptr;
                        im->im_msgtype = IGMPMSG_WRONGVIF;
                        im->im_mbz = 0;
                        im->im_vif = (ushort_t)vifi;
                        /* Pass to RAWIP */

                        bzero(&iras, sizeof (iras));
                        iras.ira_flags = IRAF_IS_IPV4;
                        iras.ira_ip_hdr_length =
                            IPH_HDR_LENGTH(mp_copy->b_rptr);
                        iras.ira_pktlen = msgdsize(mp_copy);
                        (mrouter->conn_recv)(mrouter, mp_copy, NULL, &iras);
                        ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
                }
                unlock_good_vif(&ipst->ips_vifs[vifi]);
                if (tunnel_src != 0)
                        return (1);
                else
                        return (0);
        }
        /*
         * If I sourced this packet, it counts as output, else it was input.
         */
        if (ipha->ipha_src == ipst->ips_vifs[vifi].v_lcl_addr.s_addr) {
                ipst->ips_vifs[vifi].v_pkt_out++;
                ipst->ips_vifs[vifi].v_bytes_out += plen;
        } else {
                ipst->ips_vifs[vifi].v_pkt_in++;
                ipst->ips_vifs[vifi].v_bytes_in += plen;
        }
        mutex_enter(&rt->mfc_mutex);
        rt->mfc_pkt_cnt++;
        rt->mfc_byte_cnt += plen;
        mutex_exit(&rt->mfc_mutex);
        unlock_good_vif(&ipst->ips_vifs[vifi]);
        /*
         * For each vif, decide if a copy of the packet should be forwarded.
         * Forward if:
         *              - the vif threshold ttl is non-zero AND
         *              - the pkt ttl exceeds the vif's threshold
         * A non-zero mfc_ttl indicates that the vif is part of
         * the output set for the mfc entry.
         */
        mutex_enter(&ipst->ips_numvifs_mutex);
        num_of_vifs = ipst->ips_numvifs;
        mutex_exit(&ipst->ips_numvifs_mutex);
        for (vifp = ipst->ips_vifs, vifi = 0;
            vifi < num_of_vifs;
            vifp++, vifi++) {
                if (!lock_good_vif(vifp))
                        continue;
                if ((rt->mfc_ttls[vifi] > 0) &&
                    (ipha->ipha_ttl > rt->mfc_ttls[vifi])) {
                        /*
                         * lock_good_vif should not have succedded if
                         * v_ipif is null.
                         */
                        ASSERT(vifp->v_ipif != NULL);
                        vifp->v_pkt_out++;
                        vifp->v_bytes_out += plen;
                        MC_SEND(ipha, mp, vifp, dst);
                        ipst->ips_mrtstat->mrts_fwd_out++;
                }
                unlock_good_vif(vifp);
        }
        if (tunnel_src != 0)
                return (1);
        else
                return (0);
}

/*
 * Send the packet on physical interface.
 * Caller assumes can continue to use mp on return.
 */
/* ARGSUSED */
static void
phyint_send(ipha_t *ipha, mblk_t *mp, struct vif *vifp, ipaddr_t dst)
{
        mblk_t  *mp_copy;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /* Make a new reference to the packet */
        mp_copy = copymsg(mp);  /* TODO could copy header and dup rest */
        if (mp_copy == NULL) {
                ipst->ips_mrtstat->mrts_fwd_drop++;
                ip1dbg(("phyint_send: out of memory for mblk, mp_copy\n"));
                return;
        }
        if (vifp->v_rate_limit <= 0)
                tbf_send_packet(vifp, mp_copy);
        else  {
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "phyint_send: tbf_contr rate %d "
                            "vifp 0x%p mp 0x%p dst 0x%x",
                            vifp->v_rate_limit, (void *)vifp, (void *)mp, dst);
                }
                tbf_control(vifp, mp_copy, (ipha_t *)mp_copy->b_rptr);
        }
}

/*
 * Send the whole packet for REGISTER encapsulation to PIM daemon
 * Caller assumes it can continue to use mp on return.
 */
/* ARGSUSED */
static void
register_send(ipha_t *ipha, mblk_t *mp, struct vif *vifp, ipaddr_t dst)
{
        struct igmpmsg  *im;
        mblk_t          *mp_copy;
        ipha_t          *ipha_copy;
        ill_t           *ill = vifp->v_ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        ip_recv_attr_t  iras;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "register_send: src %x, dst %x\n",
                    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst));
        }

        /*
         * Copy the old packet & pullup its IP header into the new mblk_t so we
         * can modify it.  Try to fill the new mblk_t since if we don't the
         * ethernet driver will.
         */
        mp_copy = allocb(sizeof (struct igmpmsg) + sizeof (ipha_t), BPRI_MED);
        if (mp_copy == NULL) {
                ++ipst->ips_mrtstat->mrts_pim_nomemory;
                if (ipst->ips_ip_mrtdebug > 3) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "register_send: allocb failure.");
                }
                return;
        }

        /*
         * Bump write pointer to account for igmpmsg being added.
         */
        mp_copy->b_wptr = mp_copy->b_rptr + sizeof (struct igmpmsg);

        /*
         * Chain packet to new mblk_t.
         */
        if ((mp_copy->b_cont = copymsg(mp)) == NULL) {
                ++ipst->ips_mrtstat->mrts_pim_nomemory;
                if (ipst->ips_ip_mrtdebug > 3) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "register_send: copymsg failure.");
                }
                freeb(mp_copy);
                return;
        }

        /*
         * icmp_input() asserts that IP version field is set to an
         * appropriate version. Hence, the struct igmpmsg that this really
         * becomes, needs to have the correct IP version field.
         */
        ipha_copy = (ipha_t *)mp_copy->b_rptr;
        *ipha_copy = multicast_encap_iphdr;

        /*
         * The kernel uses the struct igmpmsg header to encode the messages to
         * the multicast routing daemon. Fill in the fields in the header
         * starting with the message type which is IGMPMSG_WHOLEPKT
         */
        im = (struct igmpmsg *)mp_copy->b_rptr;
        im->im_msgtype = IGMPMSG_WHOLEPKT;
        im->im_src.s_addr = ipha->ipha_src;
        im->im_dst.s_addr = ipha->ipha_dst;

        /*
         * Must Be Zero. This is because the struct igmpmsg is really an IP
         * header with renamed fields and the multicast routing daemon uses
         * an ipha_protocol (aka im_mbz) of 0 to distinguish these messages.
         */
        im->im_mbz = 0;

        ++ipst->ips_mrtstat->mrts_upcalls;
        if (IPCL_IS_NONSTR(mrouter) ? mrouter->conn_flow_cntrld :
            !canputnext(mrouter->conn_rq)) {
                ++ipst->ips_mrtstat->mrts_pim_regsend_drops;
                if (ipst->ips_ip_mrtdebug > 3) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "register_send: register upcall failure.");
                }
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim_regsend_drops", mp_copy, ill);
                freemsg(mp_copy);
        } else {
                /* Pass to RAWIP */
                bzero(&iras, sizeof (iras));
                iras.ira_flags = IRAF_IS_IPV4;
                iras.ira_ip_hdr_length = sizeof (ipha_t);
                iras.ira_pktlen = msgdsize(mp_copy);
                (mrouter->conn_recv)(mrouter, mp_copy, NULL, &iras);
                ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
        }
}

/*
 * pim_validate_cksum handles verification of the checksum in the
 * pim header.  For PIM Register packets, the checksum is calculated
 * across the PIM header only.  For all other packets, the checksum
 * is for the PIM header and remainder of the packet.
 *
 * returns: B_TRUE, if checksum is okay.
 *          B_FALSE, if checksum is not valid.
 */
static boolean_t
pim_validate_cksum(mblk_t *mp, ipha_t *ip, struct pim *pimp)
{
        mblk_t *mp_dup;

        if ((mp_dup = dupmsg(mp)) == NULL)
                return (B_FALSE);

        mp_dup->b_rptr += IPH_HDR_LENGTH(ip);
        if (pimp->pim_type == PIM_REGISTER)
                mp_dup->b_wptr = mp_dup->b_rptr + PIM_MINLEN;
        if (IP_CSUM(mp_dup, 0, 0)) {
                freemsg(mp_dup);
                return (B_FALSE);
        }
        freemsg(mp_dup);
        return (B_TRUE);
}

/*
 * Process PIM protocol packets i.e. IP Protocol 103.
 * Register messages are decapsulated and sent onto multicast forwarding.
 *
 * Return NULL for a bad packet that is discarded here.
 * Return mp if the message is OK and should be handed to "raw" receivers.
 * Callers of pim_input() may need to reinitialize variables that were copied
 * from the mblk as this calls pullupmsg().
 */
mblk_t *
pim_input(mblk_t *mp, ip_recv_attr_t *ira)
{
        ipha_t          *eip, *ip;
        int             iplen, pimlen, iphlen;
        struct pim      *pimp;  /* pointer to a pim struct */
        uint32_t        *reghdr;
        ill_t           *ill = ira->ira_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /*
         * Pullup the msg for PIM protocol processing.
         */
        if (pullupmsg(mp, -1) == 0) {
                ++ipst->ips_mrtstat->mrts_pim_nomemory;
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim_nomemory", mp, ill);
                freemsg(mp);
                return (NULL);
        }

        ip = (ipha_t *)mp->b_rptr;
        iplen = ip->ipha_length;
        iphlen = IPH_HDR_LENGTH(ip);
        pimlen = ntohs(iplen) - iphlen;

        /*
         * Validate lengths
         */
        if (pimlen < PIM_MINLEN) {
                ++ipst->ips_mrtstat->mrts_pim_malformed;
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "pim_input: length not at least minlen");
                }
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim_malformed", mp, ill);
                freemsg(mp);
                return (NULL);
        }

        /*
         * Point to the PIM header.
         */
        pimp = (struct pim *)((caddr_t)ip + iphlen);

        /*
         * Check the version number.
         */
        if (pimp->pim_vers != PIM_VERSION) {
                ++ipst->ips_mrtstat->mrts_pim_badversion;
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "pim_input: unknown version of PIM");
                }
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim_badversion", mp, ill);
                freemsg(mp);
                return (NULL);
        }

        /*
         * Validate the checksum
         */
        if (!pim_validate_cksum(mp, ip, pimp)) {
                ++ipst->ips_mrtstat->mrts_pim_rcv_badcsum;
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "pim_input: invalid checksum");
                }
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("pim_rcv_badcsum", mp, ill);
                freemsg(mp);
                return (NULL);
        }

        if (pimp->pim_type != PIM_REGISTER)
                return (mp);

        reghdr = (uint32_t *)(pimp + 1);
        eip = (ipha_t *)(reghdr + 1);

        /*
         * check if the inner packet is destined to mcast group
         */
        if (!CLASSD(eip->ipha_dst)) {
                ++ipst->ips_mrtstat->mrts_pim_badregisters;
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "pim_input: Inner pkt not mcast .. !");
                }
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim_badregisters", mp, ill);
                freemsg(mp);
                return (NULL);
        }
        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "register from %x, to %x, len %d",
                    ntohl(eip->ipha_src),
                    ntohl(eip->ipha_dst),
                    ntohs(eip->ipha_length));
        }
        /*
         * If the null register bit is not set, decapsulate
         * the packet before forwarding it.
         * Avoid this in no register vif
         */
        if (!(ntohl(*reghdr) & PIM_NULL_REGISTER) &&
            ipst->ips_reg_vif_num != ALL_VIFS) {
                mblk_t *mp_copy;
                uint_t saved_pktlen;

                /* Copy the message */
                if ((mp_copy = copymsg(mp)) == NULL) {
                        ++ipst->ips_mrtstat->mrts_pim_nomemory;
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                        ip_drop_input("mrts_pim_nomemory", mp, ill);
                        freemsg(mp);
                        return (NULL);
                }

                /*
                 * Decapsulate the packet and give it to
                 * register_mforward.
                 */
                mp_copy->b_rptr += iphlen + sizeof (pim_t) + sizeof (*reghdr);
                saved_pktlen = ira->ira_pktlen;
                ira->ira_pktlen -= iphlen + sizeof (pim_t) + sizeof (*reghdr);
                if (register_mforward(mp_copy, ira) != 0) {
                        /* register_mforward already called ip_drop_input */
                        freemsg(mp);
                        ira->ira_pktlen = saved_pktlen;
                        return (NULL);
                }
                ira->ira_pktlen = saved_pktlen;
        }

        /*
         * Pass all valid PIM packets up to any process(es) listening on a raw
         * PIM socket. For Solaris it is done right after pim_input() is
         * called.
         */
        return (mp);
}

/*
 * PIM sparse mode hook.  Called by pim_input after decapsulating
 * the packet. Loop back the packet, as if we have received it.
 * In pim_input() we have to check if the destination is a multicast address.
 */
static int
register_mforward(mblk_t *mp, ip_recv_attr_t *ira)
{
        ire_t           *ire;
        ipha_t          *ipha = (ipha_t *)mp->b_rptr;
        ill_t           *ill = ira->ira_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        ASSERT(ipst->ips_reg_vif_num <= ipst->ips_numvifs);

        if (ipst->ips_ip_mrtdebug > 3) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "register_mforward: src %x, dst %x\n",
                    ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst));
        }
        /*
         * Need to pass in to ip_mforward() the information that the
         * packet has arrived on the register_vif. We mark it with
         * the IRAF_PIM_REGISTER attribute.
         * pim_input verified that the (inner) destination is multicast,
         * hence we skip the generic code in ip_input.
         */
        ira->ira_flags |= IRAF_PIM_REGISTER;
        ++ipst->ips_mrtstat->mrts_pim_regforwards;

        if (!CLASSD(ipha->ipha_dst)) {
                ire = ire_route_recursive_v4(ipha->ipha_dst, 0, NULL, ALL_ZONES,
                    ira->ira_tsl, MATCH_IRE_SECATTR, IRR_ALLOCATE, 0, ipst,
                    NULL, NULL, NULL);
        } else {
                ire = ire_multicast(ill);
        }
        ASSERT(ire != NULL);
        /* Normally this will return the IRE_MULTICAST */
        if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_pim RTF_REJECT", mp, ill);
                freemsg(mp);
                ire_refrele(ire);
                return (-1);
        }
        ASSERT(ire->ire_type & IRE_MULTICAST);
        (*ire->ire_recvfn)(ire, mp, ipha, ira);
        ire_refrele(ire);

        return (0);
}

/*
 * Send an encapsulated packet.
 * Caller assumes can continue to use mp when routine returns.
 */
/* ARGSUSED */
static void
encap_send(ipha_t *ipha, mblk_t *mp, struct vif *vifp, ipaddr_t dst)
{
        mblk_t  *mp_copy;
        ipha_t  *ipha_copy;
        size_t  len;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "encap_send: vif %ld enter",
                    (ptrdiff_t)(vifp - ipst->ips_vifs));
        }
        len = ntohs(ipha->ipha_length);

        /*
         * Copy the old packet & pullup it's IP header into the
         * new mbuf so we can modify it.  Try to fill the new
         * mbuf since if we don't the ethernet driver will.
         */
        mp_copy = allocb(32 + sizeof (multicast_encap_iphdr), BPRI_MED);
        if (mp_copy == NULL)
                return;
        mp_copy->b_rptr += 32;
        mp_copy->b_wptr = mp_copy->b_rptr + sizeof (multicast_encap_iphdr);
        if ((mp_copy->b_cont = copymsg(mp)) == NULL) {
                freeb(mp_copy);
                return;
        }

        /*
         * Fill in the encapsulating IP header.
         * Remote tunnel dst in rmt_addr, from add_vif().
         */
        ipha_copy = (ipha_t *)mp_copy->b_rptr;
        *ipha_copy = multicast_encap_iphdr;
        ASSERT((len + sizeof (ipha_t)) <= IP_MAXPACKET);
        ipha_copy->ipha_length = htons(len + sizeof (ipha_t));
        ipha_copy->ipha_src = vifp->v_lcl_addr.s_addr;
        ipha_copy->ipha_dst = vifp->v_rmt_addr.s_addr;
        ASSERT(ipha_copy->ipha_ident == 0);

        /* Turn the encapsulated IP header back into a valid one. */
        ipha = (ipha_t *)mp_copy->b_cont->b_rptr;
        ipha->ipha_ttl--;
        ipha->ipha_hdr_checksum = 0;
        ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);

        ipha_copy->ipha_ttl = ipha->ipha_ttl;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "encap_send: group 0x%x", ntohl(ipha->ipha_dst));
        }
        if (vifp->v_rate_limit <= 0)
                tbf_send_packet(vifp, mp_copy);
        else
                /* ipha is from the original header */
                tbf_control(vifp, mp_copy, ipha);
}

/*
 * De-encapsulate a packet and feed it back through IP input if it
 * matches one of our multicast tunnels.
 *
 * This routine is called whenever IP gets a packet with prototype
 * IPPROTO_ENCAP and a local destination address and the packet didn't
 * match one of our configured IP-in-IP tunnels.
 */
void
ip_mroute_decap(mblk_t *mp, ip_recv_attr_t *ira)
{
        ipha_t          *ipha = (ipha_t *)mp->b_rptr;
        ipha_t          *ipha_encap;
        int             hlen = IPH_HDR_LENGTH(ipha);
        int             hlen_encap;
        ipaddr_t        src;
        struct vif      *vifp;
        ire_t           *ire;
        ill_t           *ill = ira->ira_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /* Make sure we have all of the inner header */
        ipha_encap = (ipha_t *)((char *)ipha + hlen);
        if (mp->b_wptr - mp->b_rptr < hlen + IP_SIMPLE_HDR_LENGTH) {
                ipha = ip_pullup(mp, hlen + IP_SIMPLE_HDR_LENGTH, ira);
                if (ipha == NULL) {
                        ipst->ips_mrtstat->mrts_bad_tunnel++;
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                        ip_drop_input("ip_mroute_decap: too short", mp, ill);
                        freemsg(mp);
                        return;
                }
                ipha_encap = (ipha_t *)((char *)ipha + hlen);
        }
        hlen_encap = IPH_HDR_LENGTH(ipha_encap);
        if (mp->b_wptr - mp->b_rptr < hlen + hlen_encap) {
                ipha = ip_pullup(mp, hlen + hlen_encap, ira);
                if (ipha == NULL) {
                        ipst->ips_mrtstat->mrts_bad_tunnel++;
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                        ip_drop_input("ip_mroute_decap: too short", mp, ill);
                        freemsg(mp);
                        return;
                }
                ipha_encap = (ipha_t *)((char *)ipha + hlen);
        }

        /*
         * Dump the packet if it's not to a multicast destination or if
         * we don't have an encapsulating tunnel with the source.
         * Note:  This code assumes that the remote site IP address
         * uniquely identifies the tunnel (i.e., that this site has
         * at most one tunnel with the remote site).
         */
        if (!CLASSD(ipha_encap->ipha_dst)) {
                ipst->ips_mrtstat->mrts_bad_tunnel++;
                ip1dbg(("ip_mroute_decap: bad tunnel\n"));
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_bad_tunnel", mp, ill);
                freemsg(mp);
                return;
        }
        src = (ipaddr_t)ipha->ipha_src;
        mutex_enter(&ipst->ips_last_encap_lock);
        if (src != ipst->ips_last_encap_src) {
                struct vif *vife;

                vifp = ipst->ips_vifs;
                vife = vifp + ipst->ips_numvifs;
                ipst->ips_last_encap_src = src;
                ipst->ips_last_encap_vif = 0;
                for (; vifp < vife; ++vifp) {
                        if (!lock_good_vif(vifp))
                                continue;
                        if (vifp->v_rmt_addr.s_addr == src) {
                                if (vifp->v_flags & VIFF_TUNNEL)
                                        ipst->ips_last_encap_vif = vifp;
                                if (ipst->ips_ip_mrtdebug > 1) {
                                        (void) mi_strlog(mrouter->conn_rq,
                                            1, SL_TRACE,
                                            "ip_mroute_decap: good tun "
                                            "vif %ld with %x",
                                            (ptrdiff_t)(vifp - ipst->ips_vifs),
                                            ntohl(src));
                                }
                                unlock_good_vif(vifp);
                                break;
                        }
                        unlock_good_vif(vifp);
                }
        }
        if ((vifp = ipst->ips_last_encap_vif) == 0) {
                mutex_exit(&ipst->ips_last_encap_lock);
                ipst->ips_mrtstat->mrts_bad_tunnel++;
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("mrts_bad_tunnel", mp, ill);
                freemsg(mp);
                ip1dbg(("ip_mroute_decap: vif %ld no tunnel with %x\n",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), ntohl(src)));
                return;
        }
        mutex_exit(&ipst->ips_last_encap_lock);

        /*
         * Need to pass in the tunnel source to ip_mforward (so that it can
         * verify that the packet arrived over the correct vif.)
         */
        ira->ira_flags |= IRAF_MROUTE_TUNNEL_SET;
        ira->ira_mroute_tunnel = src;
        mp->b_rptr += hlen;
        ira->ira_pktlen -= hlen;
        ira->ira_ip_hdr_length = hlen_encap;

        /*
         * We don't redo any of the filtering in ill_input_full_v4 and we
         * have checked that all of ipha_encap and any IP options are
         * pulled up. Hence we call ire_recv_multicast_v4 directly.
         * However, we have to check for RSVP as in ip_input_full_v4
         * and if so we pass it to ire_recv_broadcast_v4 for local delivery
         * to the rsvpd.
         */
        if (ipha_encap->ipha_protocol == IPPROTO_RSVP &&
            ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head != NULL) {
                ire = ire_route_recursive_v4(INADDR_BROADCAST, 0, ill,
                    ALL_ZONES, ira->ira_tsl, MATCH_IRE_ILL|MATCH_IRE_SECATTR,
                    IRR_ALLOCATE, 0, ipst, NULL, NULL, NULL);
        } else {
                ire = ire_multicast(ill);
        }
        ASSERT(ire != NULL);
        /* Normally this will return the IRE_MULTICAST or IRE_BROADCAST */
        if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
                ip_drop_input("ip_mroute_decap: RTF_REJECT", mp, ill);
                freemsg(mp);
                ire_refrele(ire);
                return;
        }
        ire->ire_ib_pkt_count++;
        ASSERT(ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST));
        (*ire->ire_recvfn)(ire, mp, ipha_encap, ira);
        ire_refrele(ire);
}

/*
 * Remove all records with v_ipif == ipif.  Called when an interface goes away
 * (stream closed).  Called as writer.
 */
void
reset_mrt_vif_ipif(ipif_t *ipif)
{
        vifi_t vifi, tmp_vifi;
        vifi_t num_of_vifs;
        ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;

        /* Can't check vifi >= 0 since vifi_t is unsigned! */

        mutex_enter(&ipst->ips_numvifs_mutex);
        num_of_vifs = ipst->ips_numvifs;
        mutex_exit(&ipst->ips_numvifs_mutex);

        for (vifi = num_of_vifs; vifi != 0; vifi--) {
                tmp_vifi = vifi - 1;
                if (ipst->ips_vifs[tmp_vifi].v_ipif == ipif) {
                        (void) del_vif(&tmp_vifi, ipst);
                }
        }
}

/* Remove pending upcall msgs when ill goes away.  Called by ill_delete.  */
void
reset_mrt_ill(ill_t *ill)
{
        struct mfc      *rt;
        struct rtdetq   *rte;
        int             i;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        timeout_id_t    id;

        for (i = 0; i < MFCTBLSIZ; i++) {
                MFCB_REFHOLD(&ipst->ips_mfcs[i]);
                if ((rt = ipst->ips_mfcs[i].mfcb_mfc) != NULL) {
                        if (ipst->ips_ip_mrtdebug > 1) {
                                (void) mi_strlog(mrouter->conn_rq, 1,
                                    SL_TRACE,
                                    "reset_mrt_ill: mfctable [%d]", i);
                        }
                        while (rt != NULL) {
                                mutex_enter(&rt->mfc_mutex);
                                while ((rte = rt->mfc_rte) != NULL) {
                                        if (rte->ill == ill &&
                                            (id = rt->mfc_timeout_id) != 0) {
                                                /*
                                                 * Its ok to drop the lock,  the
                                                 * struct cannot be freed since
                                                 * we have a ref on the hash
                                                 * bucket.
                                                 */
                                                mutex_exit(&rt->mfc_mutex);
                                                (void) untimeout(id);
                                                mutex_enter(&rt->mfc_mutex);
                                        }
                                        if (rte->ill == ill) {
                                                if (ipst->ips_ip_mrtdebug > 1) {
                                                (void) mi_strlog(
                                                    mrouter->conn_rq,
                                                    1, SL_TRACE,
                                                    "reset_mrt_ill: "
                                                    "ill 0x%p", (void *)ill);
                                                }
                                                rt->mfc_rte = rte->rte_next;
                                                freemsg(rte->mp);
                                                mi_free((char *)rte);
                                        }
                                }
                                mutex_exit(&rt->mfc_mutex);
                                rt = rt->mfc_next;
                        }
                }
                MFCB_REFRELE(&ipst->ips_mfcs[i]);
        }
}

/*
 * Token bucket filter module.
 * The ipha is for mcastgrp destination for phyint and encap.
 */
static void
tbf_control(struct vif *vifp, mblk_t *mp, ipha_t *ipha)
{
        size_t  p_len =  msgdsize(mp);
        struct tbf      *t    = vifp->v_tbf;
        timeout_id_t id = 0;
        ill_t           *ill = vifp->v_ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /* Drop if packet is too large */
        if (p_len > MAX_BKT_SIZE) {
                ipst->ips_mrtstat->mrts_pkt2large++;
                BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
                ip_drop_output("tbf_control - too large", mp, ill);
                freemsg(mp);
                return;
        }
        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_ctrl: SEND vif %ld, qlen %d, ipha_dst 0x%x",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), t->tbf_q_len,
                    ntohl(ipha->ipha_dst));
        }

        mutex_enter(&t->tbf_lock);

        tbf_update_tokens(vifp);

        /*
         * If there are enough tokens,
         * and the queue is empty, send this packet out.
         */
        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_control: vif %ld, TOKENS  %d, pkt len  %lu, qlen  %d",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), t->tbf_n_tok, p_len,
                    t->tbf_q_len);
        }
        /* No packets are queued */
        if (t->tbf_q_len == 0) {
                /* queue empty, send packet if enough tokens */
                if (p_len <= t->tbf_n_tok) {
                        t->tbf_n_tok -= p_len;
                        mutex_exit(&t->tbf_lock);
                        tbf_send_packet(vifp, mp);
                        return;
                } else {
                        /* Queue packet and timeout till later */
                        tbf_queue(vifp, mp);
                        ASSERT(vifp->v_timeout_id == 0);
                        vifp->v_timeout_id = timeout(tbf_reprocess_q, vifp,
                            TBF_REPROCESS);
                }
        } else if (t->tbf_q_len < t->tbf_max_q_len) {
                /* Finite queue length, so queue pkts and process queue */
                tbf_queue(vifp, mp);
                tbf_process_q(vifp);
        } else {
                /* Check that we have UDP header with IP header */
                size_t hdr_length = IPH_HDR_LENGTH(ipha) +
                    sizeof (struct udphdr);

                if ((mp->b_wptr - mp->b_rptr) < hdr_length) {
                        if (!pullupmsg(mp, hdr_length)) {
                                BUMP_MIB(ill->ill_ip_mib,
                                    ipIfStatsOutDiscards);
                                ip_drop_output("tbf_control - pullup", mp, ill);
                                freemsg(mp);
                                ip1dbg(("tbf_ctl: couldn't pullup udp hdr, "
                                    "vif %ld src 0x%x dst 0x%x\n",
                                    (ptrdiff_t)(vifp - ipst->ips_vifs),
                                    ntohl(ipha->ipha_src),
                                    ntohl(ipha->ipha_dst)));
                                mutex_exit(&vifp->v_tbf->tbf_lock);
                                return;
                        } else
                                /* Have to reassign ipha after pullupmsg */
                                ipha = (ipha_t *)mp->b_rptr;
                }
                /*
                 * Queue length too much,
                 * try to selectively dq, or queue and process
                 */
                if (!tbf_dq_sel(vifp, ipha)) {
                        ipst->ips_mrtstat->mrts_q_overflow++;
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
                        ip_drop_output("mrts_q_overflow", mp, ill);
                        freemsg(mp);
                } else {
                        tbf_queue(vifp, mp);
                        tbf_process_q(vifp);
                }
        }
        if (t->tbf_q_len == 0) {
                id = vifp->v_timeout_id;
                vifp->v_timeout_id = 0;
        }
        mutex_exit(&vifp->v_tbf->tbf_lock);
        if (id != 0)
                (void) untimeout(id);
}

/*
 * Adds a packet to the tbf queue at the interface.
 * The ipha is for mcastgrp destination for phyint and encap.
 */
static void
tbf_queue(struct vif *vifp, mblk_t *mp)
{
        struct tbf      *t = vifp->v_tbf;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_queue: vif %ld", (ptrdiff_t)(vifp - ipst->ips_vifs));
        }
        ASSERT(MUTEX_HELD(&t->tbf_lock));

        if (t->tbf_t == NULL) {
                /* Queue was empty */
                t->tbf_q = mp;
        } else {
                /* Insert at tail */
                t->tbf_t->b_next = mp;
        }
        /* set new tail pointer */
        t->tbf_t = mp;

        mp->b_next = mp->b_prev = NULL;

        t->tbf_q_len++;
}

/*
 * Process the queue at the vif interface.
 * Drops the tbf_lock when sending packets.
 *
 * NOTE : The caller should quntimeout if the queue length is 0.
 */
static void
tbf_process_q(struct vif *vifp)
{
        mblk_t  *mp;
        struct tbf      *t = vifp->v_tbf;
        size_t  len;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_process_q 1: vif %ld qlen = %d",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), t->tbf_q_len);
        }

        /*
         * Loop through the queue at the interface and send
         * as many packets as possible.
         */
        ASSERT(MUTEX_HELD(&t->tbf_lock));

        while (t->tbf_q_len > 0) {
                mp = t->tbf_q;
                len = (size_t)msgdsize(mp); /* length of ip pkt */

                /* Determine if the packet can be sent */
                if (len <= t->tbf_n_tok) {
                        /*
                         * If so, reduce no. of tokens, dequeue the packet,
                         * send the packet.
                         */
                        t->tbf_n_tok -= len;

                        t->tbf_q = mp->b_next;
                        if (--t->tbf_q_len == 0) {
                                t->tbf_t = NULL;
                        }
                        mp->b_next = NULL;
                        /* Exit mutex before sending packet, then re-enter */
                        mutex_exit(&t->tbf_lock);
                        tbf_send_packet(vifp, mp);
                        mutex_enter(&t->tbf_lock);
                } else
                        break;
        }
}

/* Called at tbf timeout to update tokens, process q and reset timer.  */
static void
tbf_reprocess_q(void *arg)
{
        struct vif *vifp = arg;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        mutex_enter(&vifp->v_tbf->tbf_lock);
        vifp->v_timeout_id = 0;
        tbf_update_tokens(vifp);

        tbf_process_q(vifp);

        if (vifp->v_tbf->tbf_q_len > 0) {
                vifp->v_timeout_id = timeout(tbf_reprocess_q, vifp,
                    TBF_REPROCESS);
        }
        mutex_exit(&vifp->v_tbf->tbf_lock);

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_reprcess_q: vif %ld timeout id = %p",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), vifp->v_timeout_id);
        }
}

/*
 * Function that will selectively discard a member of the tbf queue,
 * based on the precedence value and the priority.
 *
 * NOTE : The caller should quntimeout if the queue length is 0.
 */
static int
tbf_dq_sel(struct vif *vifp, ipha_t *ipha)
{
        uint_t          p;
        struct tbf              *t = vifp->v_tbf;
        mblk_t          **np;
        mblk_t          *last, *mp;
        ill_t           *ill = vifp->v_ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "dq_sel: vif %ld dst 0x%x",
                    (ptrdiff_t)(vifp - ipst->ips_vifs), ntohl(ipha->ipha_dst));
        }

        ASSERT(MUTEX_HELD(&t->tbf_lock));
        p = priority(vifp, ipha);

        np = &t->tbf_q;
        last = NULL;
        while ((mp = *np) != NULL) {
                if (p > (priority(vifp, (ipha_t *)mp->b_rptr))) {
                        *np = mp->b_next;
                        /* If removing the last packet, fix the tail pointer */
                        if (mp == t->tbf_t)
                                t->tbf_t = last;
                        mp->b_prev = mp->b_next = NULL;
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
                        ip_drop_output("tbf_dq_send", mp, ill);
                        freemsg(mp);
                        /*
                         * It's impossible for the queue to be empty, but
                         * we check anyway.
                         */
                        if (--t->tbf_q_len == 0) {
                                t->tbf_t = NULL;
                        }
                        ipst->ips_mrtstat->mrts_drop_sel++;
                        return (1);
                }
                np = &mp->b_next;
                last = mp;
        }
        return (0);
}

/* Sends packet, 2 cases - encap tunnel, phyint.  */
static void
tbf_send_packet(struct vif *vifp, mblk_t *mp)
{
        ipif_t          *ipif = vifp->v_ipif;
        ill_t           *ill = ipif->ipif_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;
        ipha_t          *ipha;

        ipha = (ipha_t *)mp->b_rptr;
        /* If encap tunnel options */
        if (vifp->v_flags & VIFF_TUNNEL)  {
                ip_xmit_attr_t  ixas;

                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "tbf_send_packet: ENCAP tunnel vif %ld",
                            (ptrdiff_t)(vifp - ipst->ips_vifs));
                }
                bzero(&ixas, sizeof (ixas));
                ixas.ixa_flags =
                    IXAF_IS_IPV4 | IXAF_NO_TTL_CHANGE | IXAF_VERIFY_SOURCE;
                ixas.ixa_ipst = ipst;
                ixas.ixa_ifindex = 0;
                ixas.ixa_cred = kcred;
                ixas.ixa_cpid = NOPID;
                ixas.ixa_tsl = NULL;
                ixas.ixa_zoneid = GLOBAL_ZONEID; /* Multicast router in GZ */
                ixas.ixa_pktlen = ntohs(ipha->ipha_length);
                ixas.ixa_ip_hdr_length = IPH_HDR_LENGTH(ipha);

                /*
                 * Feed into ip_output_simple which will set the ident field
                 * and checksum the encapsulating header.
                 * BSD gets the cached route vifp->v_route from ip_output()
                 * to speed up route table lookups. Not necessary in SunOS 5.x.
                 * One could make multicast forwarding faster by putting an
                 * ip_xmit_attr_t in each vif thereby caching the ire/nce.
                 */
                (void) ip_output_simple(mp, &ixas);
                ixa_cleanup(&ixas);
                return;

                /* phyint */
        } else {
                /* Need to loop back to members on the outgoing interface. */
                ipaddr_t        dst;
                ip_recv_attr_t  iras;
                nce_t           *nce;

                bzero(&iras, sizeof (iras));
                iras.ira_flags = IRAF_IS_IPV4;
                iras.ira_ill = iras.ira_rill = ill;
                iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
                iras.ira_zoneid = GLOBAL_ZONEID; /* Multicast router in GZ */
                iras.ira_pktlen = ntohs(ipha->ipha_length);
                iras.ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);

                dst = ipha->ipha_dst;
                if (ill_hasmembers_v4(ill, dst)) {
                        iras.ira_flags |= IRAF_LOOPBACK_COPY;
                }
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "tbf_send_pkt: phyint forward  vif %ld dst = 0x%x",
                            (ptrdiff_t)(vifp - ipst->ips_vifs), ntohl(dst));
                }
                /*
                 * Find an NCE which matches the nexthop.
                 * For a pt-pt interface we use the other end of the pt-pt
                 * link.
                 */
                if (ipif->ipif_flags & IPIF_POINTOPOINT) {
                        dst = ipif->ipif_pp_dst_addr;
                        nce = arp_nce_init(ill, dst, ill->ill_net_type);
                } else {
                        nce = arp_nce_init(ill, dst, IRE_MULTICAST);
                }
                if (nce == NULL) {
                        BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
                        ip_drop_output("tbf_send_packet - no nce", mp, ill);
                        freemsg(mp);
                        return;
                }

                /*
                 * We don't remeber the incoming ill. Thus we
                 * pretend the  packet arrived on the outbound ill. This means
                 * statistics for input errors will be increased on the wrong
                 * ill but that isn't a big deal.
                 */
                ip_forward_xmit_v4(nce, ill, mp, ipha, &iras, ill->ill_mc_mtu,
                    0);
                ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));

                nce_refrele(nce);
        }
}

/*
 * Determine the current time and then the elapsed time (between the last time
 * and time now).  Update the no. of tokens in the bucket.
 */
static void
tbf_update_tokens(struct vif *vifp)
{
        timespec_t      tp;
        hrtime_t        tm;
        struct tbf      *t = vifp->v_tbf;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        ASSERT(MUTEX_HELD(&t->tbf_lock));

        /* Time in secs and nsecs, rate limit in kbits/sec */
        gethrestime(&tp);

        /*LINTED*/
        TV_DELTA(tp, t->tbf_last_pkt_t, tm);

        /*
         * This formula is actually
         * "time in seconds" * "bytes/second".  Scaled for nsec.
         * (tm/1000000000) * (v_rate_limit * 1000 * (1000/1024) /8)
         *
         * The (1000/1024) was introduced in add_vif to optimize
         * this divide into a shift.
         */
        t->tbf_n_tok += (tm/1000) * vifp->v_rate_limit / 1024 / 8;
        t->tbf_last_pkt_t = tp;

        if (t->tbf_n_tok > MAX_BKT_SIZE)
                t->tbf_n_tok = MAX_BKT_SIZE;
        if (ipst->ips_ip_mrtdebug > 1) {
                (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                    "tbf_update_tok: tm %lld tok %d vif %ld",
                    tm, t->tbf_n_tok, (ptrdiff_t)(vifp - ipst->ips_vifs));
        }
}

/*
 * Priority currently is based on port nos.
 * Different forwarding mechanisms have different ways
 * of obtaining the port no. Hence, the vif must be
 * given along with the packet itself.
 *
 */
static int
priority(struct vif *vifp, ipha_t *ipha)
{
        int prio;
        ip_stack_t      *ipst = vifp->v_ipif->ipif_ill->ill_ipst;
        conn_t          *mrouter = ipst->ips_ip_g_mrouter;

        /* Temporary hack; may add general packet classifier some day */

        ASSERT(MUTEX_HELD(&vifp->v_tbf->tbf_lock));

        /*
         * The UDP port space is divided up into four priority ranges:
         * [0, 16384)   : unclassified - lowest priority
         * [16384, 32768)       : audio - highest priority
         * [32768, 49152)       : whiteboard - medium priority
         * [49152, 65536)       : video - low priority
         */

        if (ipha->ipha_protocol == IPPROTO_UDP) {
                struct udphdr *udp =
                    (struct udphdr *)((char *)ipha + IPH_HDR_LENGTH(ipha));
                switch (ntohs(udp->uh_dport) & 0xc000) {
                case 0x4000:
                        prio = 70;
                        break;
                case 0x8000:
                        prio = 60;
                        break;
                case 0xc000:
                        prio = 55;
                        break;
                default:
                        prio = 50;
                        break;
                }
                if (ipst->ips_ip_mrtdebug > 1) {
                        (void) mi_strlog(mrouter->conn_rq, 1, SL_TRACE,
                            "priority: port %x prio %d\n",
                            ntohs(udp->uh_dport), prio);
                }
        } else
                prio = 50;  /* default priority */
        return (prio);
}

/*
 * End of token bucket filter modifications
 */



/*
 * Produces data for netstat -M.
 */
int
ip_mroute_stats(mblk_t *mp, ip_stack_t *ipst)
{
        ipst->ips_mrtstat->mrts_vifctlSize = sizeof (struct vifctl);
        ipst->ips_mrtstat->mrts_mfcctlSize = sizeof (struct mfcctl);
        if (!snmp_append_data(mp, (char *)ipst->ips_mrtstat,
                sizeof (struct mrtstat))) {
                ip0dbg(("ip_mroute_stats: failed %ld bytes\n",
                    (size_t)sizeof (struct mrtstat)));
                return (0);
        }
        return (1);
}

/*
 * Sends info for SNMP's MIB.
 */
int
ip_mroute_vif(mblk_t *mp, ip_stack_t *ipst)
{
        struct vifctl   vi;
        vifi_t          vifi;

        mutex_enter(&ipst->ips_numvifs_mutex);
        for (vifi = 0; vifi < ipst->ips_numvifs; vifi++) {
                if (ipst->ips_vifs[vifi].v_lcl_addr.s_addr == 0)
                        continue;
                /*
                 * No locks here, an approximation is fine.
                 */
                vi.vifc_vifi = vifi;
                vi.vifc_flags = ipst->ips_vifs[vifi].v_flags;
                vi.vifc_threshold = ipst->ips_vifs[vifi].v_threshold;
                vi.vifc_rate_limit      = ipst->ips_vifs[vifi].v_rate_limit;
                vi.vifc_lcl_addr        = ipst->ips_vifs[vifi].v_lcl_addr;
                vi.vifc_rmt_addr        = ipst->ips_vifs[vifi].v_rmt_addr;
                vi.vifc_pkt_in          = ipst->ips_vifs[vifi].v_pkt_in;
                vi.vifc_pkt_out         = ipst->ips_vifs[vifi].v_pkt_out;

                if (!snmp_append_data(mp, (char *)&vi, sizeof (vi))) {
                        ip0dbg(("ip_mroute_vif: failed %ld bytes\n",
                            (size_t)sizeof (vi)));
                        mutex_exit(&ipst->ips_numvifs_mutex);
                        return (0);
                }
        }
        mutex_exit(&ipst->ips_numvifs_mutex);
        return (1);
}

/*
 * Called by ip_snmp_get to send up multicast routing table.
 */
int
ip_mroute_mrt(mblk_t *mp, ip_stack_t *ipst)
{
        int                     i, j;
        struct mfc              *rt;
        struct mfcctl   mfcc;

        /*
         * Make sure multicast has not been turned off.
         */
        if (is_mrouter_off(ipst))
                return (1);

        /* Loop over all hash buckets and their chains */
        for (i = 0; i < MFCTBLSIZ; i++) {
                MFCB_REFHOLD(&ipst->ips_mfcs[i]);
                for (rt = ipst->ips_mfcs[i].mfcb_mfc; rt; rt = rt->mfc_next) {
                        mutex_enter(&rt->mfc_mutex);
                        if (rt->mfc_rte != NULL ||
                            (rt->mfc_marks & MFCB_MARK_CONDEMNED)) {
                                mutex_exit(&rt->mfc_mutex);
                                continue;
                        }
                        mfcc.mfcc_origin = rt->mfc_origin;
                        mfcc.mfcc_mcastgrp = rt->mfc_mcastgrp;
                        mfcc.mfcc_parent = rt->mfc_parent;
                        mfcc.mfcc_pkt_cnt = rt->mfc_pkt_cnt;
                        mutex_enter(&ipst->ips_numvifs_mutex);
                        for (j = 0; j < (int)ipst->ips_numvifs; j++)
                                mfcc.mfcc_ttls[j] = rt->mfc_ttls[j];
                        for (j = (int)ipst->ips_numvifs; j < MAXVIFS; j++)
                                mfcc.mfcc_ttls[j] = 0;
                        mutex_exit(&ipst->ips_numvifs_mutex);

                        mutex_exit(&rt->mfc_mutex);
                        if (!snmp_append_data(mp, (char *)&mfcc,
                            sizeof (mfcc))) {
                                MFCB_REFRELE(&ipst->ips_mfcs[i]);
                                ip0dbg(("ip_mroute_mrt: failed %ld bytes\n",
                                    (size_t)sizeof (mfcc)));
                                return (0);
                        }
                }
                MFCB_REFRELE(&ipst->ips_mfcs[i]);
        }
        return (1);
}